{"id":"CVE-2026-21637","aliases":["ALPINE-CVE-2026-21637","ALSA-2026:1842","ALSA-2026:1843","ALSA-2026:2420","ALSA-2026:2421","ALSA-2026:2422","ALSA-2026:2781","ALSA-2026:2782","ALSA-2026:2783","ALSA-2026:7350","ALSA-2026:7670","ALSA-2026:7675","AZL-75080","BELL-CVE-2026-21637","BIT-node-2026-21637","BIT-node-min-2026-21637","CLSA-2026-1770993656","CLSA-2026-1771236630","DEBIAN-CVE-2026-21637","DSA-6166-1","DSA-6183-1","EUVD-2026-3327","GHSA-ggxc-26fx-987r","MGASA-2026-0009","MGASA-2026-0071","OESA-2026-1218","OESA-2026-1219","OESA-2026-1220","OESA-2026-1221","OESA-2026-2820","OESA-2026-2821","RHSA-2026:1842","RHSA-2026:1843","RHSA-2026:2420","RHSA-2026:2421","RHSA-2026:2422","RHSA-2026:2767","RHSA-2026:2768","RHSA-2026:2781","RHSA-2026:2782","RHSA-2026:2783","RHSA-2026:2864","RHSA-2026:2899","RHSA-2026:6402","RHSA-2026:6431","RHSA-2026:7350","RHSA-2026:7386","RHSA-2026:7387","RHSA-2026:7670","RHSA-2026:7675","RLSA-2026:1842","RLSA-2026:1843","RLSA-2026:2420","RLSA-2026:2421","RLSA-2026:2422","RLSA-2026:2781","RLSA-2026:2782","RLSA-2026:2783","RLSA-2026:7350","RLSA-2026:7670","RLSA-2026:7675","SUSE-SU-2026:0295-1","SUSE-SU-2026:0301-1","SUSE-SU-2026:0435-1","SUSE-SU-2026:0457-1","SUSE-SU-2026:1299-1","SUSE-SU-2026:1363-1","SUSE-SU-2026:1371-1","SUSE-SU-2026:1478-1","SUSE-SU-2026:1509-1","SUSE-SU-2026:20436-1","SUSE-SU-2026:21181-1","SUSE-SU-2026:22368-1","SUSE-SU-2026:4248-1","SUSE-SU-2026:4261-1","SUSE-SU-2026:4355-1","UBUNTU-CVE-2026-21637","openSUSE-SU-2026:10062-1","openSUSE-SU-2026:10074-1","openSUSE-SU-2026:11110-1","openSUSE-SU-2026:20236-1","openSUSE-SU-2026:20519-1","openSUSE-SU-2026:21058-1"],"status":"published","title":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01119,"percentile":0.66413,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-01-17T00:00:00Z","modified":"2026-10-29T11:32:37Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["22.22.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["22.22.0-r0","22.22.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["24.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["24.14.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-13"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nodejs","fixed_in":["20.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs","fixed_in":["22.22.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["24.14.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","fixed_in":["20.20.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs","fixed_in":["22.22.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["24.14.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["20.20.0","22.22.0","24.13.0","25.3.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.20.0","22.22.0","24.13.0","25.3.0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["18.20.4+dfsg-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["20.19.2+dfsg-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["22.22.2+dfsg+~cs22.19.15-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-r0"},{"fixed":"22.22.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.14.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.6.2-1.24.13.0.1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module_el8.10.0+4113+bc863bc2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module_el8.10.0+4113+bc863bc2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module_el8.10.0+4113+bc863bc2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module_el8.10.0+4113+bc863bc2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module_el8.10.0+4113+bc863bc2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-1.module_el8.10.0+4061+f8ceeab9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.6.2-1.24.13.0.0.module_el8.10.0+4113+bc863bc2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.13.0.0.module_el8.10.0+4113+bc863bc2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el8.10.0+4112+db1af44b"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el8.10.0+4112+db1af44b"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el8.10.0+4112+db1af44b"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el8.10.0+4112+db1af44b"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el8.10.0+4112+db1af44b"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+4006+3c416519"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-5.module_el8.10.0+4085+6f807d30"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-5.module_el8.10.0+4085+6f807d30"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.4-1.22.22.0.1.module_el8.10.0+4112+db1af44b"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.0.1.module_el8.10.0+4112+db1af44b"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+3982+85c136aa"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-5.module_el8.10.0+4084+7c0af990"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-5.module_el8.10.0+4084+7c0af990"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+198+8bf605ba"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.6.2-1.24.13.0.1.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.13.0.1.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el9.7.0+208+fb06c0ab"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el9.7.0+208+fb06c0ab"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el9.7.0+208+fb06c0ab"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el9.7.0+208+fb06c0ab"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module_el9.7.0+208+fb06c0ab"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.6.0+172+f0ba00ec"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-5.module_el9.7.0+208+fb06c0ab"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-5.module_el9.7.0+196+ac40ca3b"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.4-1.22.22.0.1.module_el9.7.0+208+fb06c0ab"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.0.1.module_el9.7.0+208+fb06c0ab"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module_el9.7.0+207+84573810"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module_el9.7.0+207+84573810"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module_el9.7.0+207+84573810"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module_el9.7.0+207+84573810"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.5.0+125+8dc38870"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-5.module_el9.7.0+207+84573810"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-5.module_el9.7.0+207+84573810"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.20.0.1.module_el9.7.0+207+84573810"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.module_el9.7.0+209+ecf6523e"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+198+8bf605ba"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-1.module_el8.10.0+4061+f8ceeab9"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-13"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"},{"fixed":"20.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.16.0-r1"},{"fixed":"22.22.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"24.14.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"},{"fixed":"20.20.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.16.0-r1"},{"fixed":"22.22.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"24.14.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.20.0"},{"introduced":"21.0.0"},{"fixed":"22.22.0"},{"introduced":"23.0.0"},{"fixed":"24.13.0"},{"introduced":"25.0.0"},{"fixed":"25.3.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.20.0"},{"introduced":"21.0.0"},{"fixed":"22.22.0"},{"introduced":"23.0.0"},{"fixed":"24.13.0"},{"introduced":"25.0.0"},{"fixed":"25.3.0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4+dfsg-1~deb12u2"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5","18.19.0+dfsg-6","18.19.0+dfsg-6~deb12u1","18.19.0+dfsg-6~deb12u2","18.19.1+dfsg-1","18.19.1+dfsg-2","18.19.1+dfsg-3","18.19.1+dfsg-3.1","18.19.1+dfsg-4","18.19.1+dfsg-6","18.20.1+dfsg-1","18.20.1+dfsg-2","18.20.1+dfsg-3","18.20.1+dfsg-4","18.20.4+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2+dfsg-1+deb13u2"}]}],"versions":["20.19.2+dfsg-1","20.19.2+dfsg-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.2+dfsg+~cs22.19.15-1"}]}],"versions":["20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2+dfsg-1+deb13u1"}]}],"versions":["20.19.2+dfsg-1"],"bundled":7},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2+dfsg-1+deb13u2"}]}],"versions":["20.19.2+dfsg-1","20.19.2+dfsg-1+deb13u1"],"bundled":7},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.2-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-5.oe2403sp2"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-5.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-5.oe2403"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-5.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-11.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-13.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.6.2-1.24.13.0.1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.4-1.22.22.0.3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-1.module+el8.10.0+23730+2ad7beb8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+23730+2ad7beb8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+23730+2ad7beb8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.6.2-1.24.13.0.0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.13.0.0.module+el8.10.0+23888+24fa7806"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+23474+222d264a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el8.10.0+23590+1e59695e"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el8.10.0+23590+1e59695e"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.4-1.22.22.0.1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.0.1.module+el8.10.0+23904+2c92f862"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el8.10.0+23905+c49b2aec"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el8.10.0+23905+c49b2aec"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el8.10.0+23905+c49b2aec"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el8.10.0+23905+c49b2aec"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el8.10.0+23905+c49b2aec"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el8.10.0+23905+c49b2aec"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+23521+490ebfde"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el8.10.0+23591+ff544af9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el8.10.0+23591+ff544af9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.20.0.1.module+el8.10.0+23905+c49b2aec"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.6.0+23988+6b9eae47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.6.0+23988+6b9eae47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.6.0+23988+6b9eae47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.6.0+23988+6b9eae47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.6.0+23988+6b9eae47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.6.0+23988+6b9eae47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23146+be9976bd"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23146+be9976bd"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.20.0.1.module+el9.6.0+23988+6b9eae47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.4.0+23992+5dc31998"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.4.0+23992+5dc31998"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.4.0+23992+5dc31998"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.4.0+23992+5dc31998"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.4.0+23992+5dc31998"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.4.0+23992+5dc31998"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.20.0.1.module+el9.4.0+23992+5dc31998"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.6.2-1.24.13.0.1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.13.0.1.module+el9.7.0+23894+c8377628"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.4-1.22.22.0.1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.0.1.module+el9.7.0+23896+b5802de9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.20.0.1.module+el9.7.0+23895+0637d423"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23473+45664c2d"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.4-1.22.22.0.1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.0.1.module+el9.6.0+23985+21730e4b"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.4-1.22.22.0.1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.el10_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.14.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.14.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.14.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.14.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.14.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.14.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.11.0-1.24.14.1.4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.14.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.12.1-1.25.9.0.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.0-7.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.0-7.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.0-7.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.0-7.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.0-7.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.0-7.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.8.2-1.20.20.0.7.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.0-7.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.4-1.22.22.0.1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-1.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-1.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-3.el10_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.13.0-0.module+el8.10.0+40079+1d83e08b"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-1.module+el8.10.0+2084+ab509703"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.0-1.module+el8.10.0+40078+280dc7ce"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.20.0-1.module+el8.10.0+40077+29236b21"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40017+f0db1785"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40022+9ecc286c"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40018+a011993d"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el9.7.0+40050+22a42328"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el9.7.0+40051+f2ef3f49"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40017+f0db1785"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40022+9ecc286c"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40018+a011993d"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el9.7.0+40050+22a42328"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-5.module+el9.7.0+40051+f2ef3f49"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-1.module+el8.10.0+2084+ab509703"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-150600.13.12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-150600.13.12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-150600.13.12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-150700.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.0-150600.3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.0-150600.3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.0-150600.3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.0-150500.11.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.0-150500.11.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.0-150500.11.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.0-150500.11.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.14.1-150700.15.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150600.3.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150600.3.18.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.2-150700.3.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.2-150600.13.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.2-150600.13.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.14.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.14.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2","0.10.25~dfsg2-2ubuntu1.2+esm1","0.10.25~dfsg2-2ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2","10.19.0~dfsg-3ubuntu1.3","10.19.0~dfsg-3ubuntu1.5","10.19.0~dfsg-3ubuntu1.6","10.19.0~dfsg-3ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.18.1+dfsg-1ubuntu2","20.19.2+dfsg-1","20.19.4+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-4","22.21.1+dfsg+~cs22.19.0-6ubuntu4","22.22.0+dfsg+~cs22.19.6-1ubuntu2","22.22.0+dfsg+~cs22.19.13-2ubuntu1","22.22.1+dfsg+~cs22.19.15-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.13.0-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.3.1-1.1"}]}],"bundled":37},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.22.0-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.14.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-160000.1.1"}]}],"bundled":26}],"products":[{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","tags":["Release Notes","Vendor Advisory","advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21637","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ggxc-26fx-987r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-21637","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1842","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55130","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55131","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55132","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59465","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59466","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21637","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431338","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431340","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431343","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431349","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431350","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431352","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-1842.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1843","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-1843.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2420","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-2420.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2421","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-2421.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2422","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-2422.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2781","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-2781.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2782","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-2782.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2783","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-2783.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7350","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1525","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1526","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1527","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1528","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21710","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21711","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21712","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21713","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21714","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21715","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21716","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2229","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25547","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2581","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26996","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27135","tags":["report"]},{"url":"https://bugzilla.redhat.com/2436942","tags":["report"]},{"url":"https://bugzilla.redhat.com/2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447140","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447141","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447142","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447143","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447144","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447145","tags":["report"]},{"url":"https://bugzilla.redhat.com/2448754","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453037","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453151","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453152","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453157","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453158","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453160","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453161","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453162","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-7350.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7670","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-7670.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7675","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7675.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-21637","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1770993656.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1771236630.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21637.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-21637","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0009.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34995","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v22.22.0","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2026-0071.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35270","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","tags":["web","article"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59466","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1219","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1220","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1221","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21714","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2821","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431343","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431352","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1842.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55130","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55131","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55132","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59465","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59466","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21637","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1843.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-135257","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2420.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-118152","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2421.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-130972","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2422.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2767","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2767.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2768","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2768.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2781.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2782.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2783.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2864","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2864.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2899","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2899.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6402","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21636","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59464","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6402.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59464","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21636","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453157","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21716","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21717","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6431","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6431.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453161","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7350.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1525","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://cwe.mitre.org/data/definitions/444.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm","tags":["article"]},{"url":"https://hackerone.com/reports/3556037","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1526","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc7692","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q","tags":["article"]},{"url":"https://hackerone.com/reports/3481206","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1527","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1527","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq","tags":["article"]},{"url":"https://hackerone.com/reports/3487198","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1528","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj","tags":["article"]},{"url":"https://hackerone.com/reports/3537648","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8","tags":["article"]},{"url":"https://hackerone.com/reports/3487486","tags":["article"]},{"url":"https://nodejs.org/api/zlib.html#class-zlibinflateraw","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2581","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h","tags":["article"]},{"url":"https://hackerone.com/reports/3513473","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21710","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21711","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21712","tags":["advisory"]},{"url":"https://hackerone.com/reports/3546390","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21713","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21714","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21715","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25547","tags":["advisory"]},{"url":"https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","tags":["article"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","tags":["article"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7386","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7386.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7387","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45149","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7387.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-151374","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7670.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7675.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:1842","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:1843","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2420","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2421","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2422","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2781","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2782","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2783","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7350","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7670","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7675","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260295-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256569","tags":["report"]},{"url":"https://bugzilla.suse.com/1256570","tags":["report"]},{"url":"https://bugzilla.suse.com/1256571","tags":["report"]},{"url":"https://bugzilla.suse.com/1256573","tags":["report"]},{"url":"https://bugzilla.suse.com/1256574","tags":["report"]},{"url":"https://bugzilla.suse.com/1256576","tags":["report"]},{"url":"https://bugzilla.suse.com/1256848","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260301-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260435-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260457-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261299-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256572","tags":["report"]},{"url":"https://bugzilla.suse.com/1260455","tags":["report"]},{"url":"https://bugzilla.suse.com/1260460","tags":["report"]},{"url":"https://bugzilla.suse.com/1260462","tags":["report"]},{"url":"https://bugzilla.suse.com/1260463","tags":["report"]},{"url":"https://bugzilla.suse.com/1260480","tags":["report"]},{"url":"https://bugzilla.suse.com/1260482","tags":["report"]},{"url":"https://bugzilla.suse.com/1260494","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261363-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261371-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261478-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261509-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620436-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621181-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259853","tags":["report"]},{"url":"https://bugzilla.suse.com/1262274","tags":["report"]},{"url":"https://bugzilla.suse.com/1266318","tags":["report"]},{"url":"https://bugzilla.suse.com/1268097","tags":["report"]},{"url":"https://bugzilla.suse.com/1268477","tags":["report"]},{"url":"https://bugzilla.suse.com/1268479","tags":["report"]},{"url":"https://bugzilla.suse.com/1268481","tags":["report"]},{"url":"https://bugzilla.suse.com/1268482","tags":["report"]},{"url":"https://bugzilla.suse.com/1268554","tags":["report"]},{"url":"https://bugzilla.suse.com/1268555","tags":["report"]},{"url":"https://bugzilla.suse.com/1268592","tags":["report"]},{"url":"https://bugzilla.suse.com/1268593","tags":["report"]},{"url":"https://bugzilla.suse.com/1268598","tags":["report"]},{"url":"https://bugzilla.suse.com/1268605","tags":["report"]},{"url":"https://bugzilla.suse.com/1268606","tags":["report"]},{"url":"https://bugzilla.suse.com/1268608","tags":["report"]},{"url":"https://bugzilla.suse.com/1268609","tags":["report"]},{"url":"https://bugzilla.suse.com/1268611","tags":["report"]},{"url":"https://bugzilla.suse.com/1268618","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264248-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236258","tags":["report"]},{"url":"https://bugzilla.suse.com/1243218","tags":["report"]},{"url":"https://bugzilla.suse.com/1243220","tags":["report"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://bugzilla.suse.com/1269825","tags":["report"]},{"url":"https://bugzilla.suse.com/1272941","tags":["report"]},{"url":"https://bugzilla.suse.com/1272942","tags":["report"]},{"url":"https://bugzilla.suse.com/1272943","tags":["report"]},{"url":"https://bugzilla.suse.com/1272944","tags":["report"]},{"url":"https://bugzilla.suse.com/1272945","tags":["report"]},{"url":"https://bugzilla.suse.com/1272947","tags":["report"]},{"url":"https://bugzilla.suse.com/1272948","tags":["report"]},{"url":"https://bugzilla.suse.com/1272951","tags":["report"]},{"url":"https://bugzilla.suse.com/1272958","tags":["report"]},{"url":"https://bugzilla.suse.com/1273591","tags":["report"]},{"url":"https://bugzilla.suse.com/1273593","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58045","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264261-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264355-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236250","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-21637","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-21637","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","status":"published","published":"2026-01-20T20:41:55.352Z","modified":"2026-01-21T20:22:51.033Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-3327","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","status":"published","published":"2026-01-20T20:41:55Z","modified":"2026-01-21T20:22:51Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:49.473592Z"}],"ghsa":[{"id":"GHSA-ggxc-26fx-987r","title":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","status":"published","published":"2026-01-20T21:31:35Z","modified":"2026-01-21T21:30:30Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:05:50.792909Z"}],"nvd":[{"id":"CVE-2026-21637","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","status":"published","published":"2026-01-20T21:16:05.95Z","modified":"2026-06-17T10:18:51.183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"ALPINE-CVE-2026-21637","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","status":"published","published":"2026-01-20T21:16:05.95Z","modified":"2026-10-01T02:17:49.203521114Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-21637","status":"published","published":"2026-01-17T01:31:36.304852Z","modified":"2026-03-28T07:17:20.312407Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-21637","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","status":"published","published":"2026-01-20T20:41:55.352Z","modified":"2026-10-28T02:30:34.429159703Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"DEBIAN-CVE-2026-21637","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","status":"published","published":"2026-01-20T21:16:05.95Z","modified":"2026-10-01T03:03:08.135217368Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"OESA-2026-1218","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.(CVE-2025-55130)\n\nNode.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include:\n1.  **CVE-2025-55131 (High)**: A flaw in Node.js\u0026apos;s buffer allocation logic can expose uninitialized memory when allocations are interrupted using the `vm` module with the `timeout` option. Buffers allocated with `Buffer.alloc` and other TypedArray instances like `Uint8Array` may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption.\n2.  **CVE-2025-55130 (High)**: A flaw in Node.js\u0026apos;s Permissions model allows attackers to bypass `\n3.  **CVE-2025-59465 (High)**: A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket error, leading to a remote denial of service.\n4.  **CVE-2025-59466 (Medium)**: A bug in Node.js error handling makes \u0026quot;Maximum call stack size exceeded\u0026quot; errors uncatchable when `async_hooks.createHook()` is enabled, causing the process to terminate unrecoverably.\n5.  **CVE-2025-59464 (Medium)**: A memory leak in Node.js\u0026apos;s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during `socket.getPeerCertificate(true)`, allowing remote memory exhaustion.\n6.  **CVE-2026-21636 (Medium)**: A flaw in Node.js\u0026apos;s permission model allows Unix Domain Socket connections to bypass network restrictions even without `\n7.  **CVE-2026-21637 (Medium)**: A flaw in Node.js TLS error handling allows synchronous exceptions thrown during `pskCallback` or `ALPNCallback` to bypass standard error handlers, causing process termination or file descriptor leaks.\n8.  **CVE-2025-55132 (Low)**: A flaw in Node.js\u0026apos;s permission model allows file timestamps to be changed via `fs.futimes()` even with only read permissions, potentially obscuring activity in logs.(CVE-2025-55131)\n\nA flaw in Node.js\u0026apos;s permission model allows a file\u0026apos;s access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.(CVE-2025-55132)\n\nA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on(\u0026apos;secureConnection\u0026apos;, socket =\u0026gt; {\n  socket.on(\u0026apos;error\u0026apos;, err =\u0026gt; {\n    console.log(err)\n  })\n})\n```(CVE-2025-59465)\n\nWe have identified a bug in Node.js error handling where \u0026quot;Maximum call stack size exceeded\u0026quot; errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on(\u0026apos;uncaughtException\u0026apos;)`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.(CVE-2025-59466)\n\nThis is a security vulnerability that has been assigned a CVE identifier (CVE-2026-21637). Currently, in the vulnerability information from SUSE, the title, description, and relief fields are empty, and the list of affected packages is also empty. This indicates that the detailed information of this vulnerability may still be under investigation, assignment, or in a reserved state, and specific technical details, scope of impact, and attack vectors have not been publicly disclosed. It is recommended to monitor official security advisories for subsequent updates.(CVE-2026-21637)","status":"published","published":"2026-01-23T11:10:15Z","modified":"2026-08-18T01:19:30.053751222Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1219","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.(CVE-2025-55130)\n\nNode.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include:\n1.  **CVE-2025-55131 (High)**: A flaw in Node.js\u0026apos;s buffer allocation logic can expose uninitialized memory when allocations are interrupted using the `vm` module with the `timeout` option. Buffers allocated with `Buffer.alloc` and other TypedArray instances like `Uint8Array` may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption.\n2.  **CVE-2025-55130 (High)**: A flaw in Node.js\u0026apos;s Permissions model allows attackers to bypass `\n3.  **CVE-2025-59465 (High)**: A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket error, leading to a remote denial of service.\n4.  **CVE-2025-59466 (Medium)**: A bug in Node.js error handling makes \u0026quot;Maximum call stack size exceeded\u0026quot; errors uncatchable when `async_hooks.createHook()` is enabled, causing the process to terminate unrecoverably.\n5.  **CVE-2025-59464 (Medium)**: A memory leak in Node.js\u0026apos;s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during `socket.getPeerCertificate(true)`, allowing remote memory exhaustion.\n6.  **CVE-2026-21636 (Medium)**: A flaw in Node.js\u0026apos;s permission model allows Unix Domain Socket connections to bypass network restrictions even without `\n7.  **CVE-2026-21637 (Medium)**: A flaw in Node.js TLS error handling allows synchronous exceptions thrown during `pskCallback` or `ALPNCallback` to bypass standard error handlers, causing process termination or file descriptor leaks.\n8.  **CVE-2025-55132 (Low)**: A flaw in Node.js\u0026apos;s permission model allows file timestamps to be changed via `fs.futimes()` even with only read permissions, potentially obscuring activity in logs.(CVE-2025-55131)\n\nA flaw in Node.js\u0026apos;s permission model allows a file\u0026apos;s access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.(CVE-2025-55132)\n\nA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on(\u0026apos;secureConnection\u0026apos;, socket =\u0026gt; {\n  socket.on(\u0026apos;error\u0026apos;, err =\u0026gt; {\n    console.log(err)\n  })\n})\n```(CVE-2025-59465)\n\nWe have identified a bug in Node.js error handling where \u0026quot;Maximum call stack size exceeded\u0026quot; errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on(\u0026apos;uncaughtException\u0026apos;)`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.(CVE-2025-59466)\n\nThis is a security vulnerability that has been assigned a CVE identifier (CVE-2026-21637). Currently, in the vulnerability information from SUSE, the title, description, and relief fields are empty, and the list of affected packages is also empty. This indicates that the detailed information of this vulnerability may still be under investigation, assignment, or in a reserved state, and specific technical details, scope of impact, and attack vectors have not been publicly disclosed. It is recommended to monitor official security advisories for subsequent updates.(CVE-2026-21637)","status":"published","published":"2026-01-23T11:10:15Z","modified":"2026-08-18T01:19:30.060407944Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1220","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.(CVE-2025-55130)\n\nNode.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include:\n1.  **CVE-2025-55131 (High)**: A flaw in Node.js\u0026apos;s buffer allocation logic can expose uninitialized memory when allocations are interrupted using the `vm` module with the `timeout` option. Buffers allocated with `Buffer.alloc` and other TypedArray instances like `Uint8Array` may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption.\n2.  **CVE-2025-55130 (High)**: A flaw in Node.js\u0026apos;s Permissions model allows attackers to bypass `\n3.  **CVE-2025-59465 (High)**: A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket error, leading to a remote denial of service.\n4.  **CVE-2025-59466 (Medium)**: A bug in Node.js error handling makes \u0026quot;Maximum call stack size exceeded\u0026quot; errors uncatchable when `async_hooks.createHook()` is enabled, causing the process to terminate unrecoverably.\n5.  **CVE-2025-59464 (Medium)**: A memory leak in Node.js\u0026apos;s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during `socket.getPeerCertificate(true)`, allowing remote memory exhaustion.\n6.  **CVE-2026-21636 (Medium)**: A flaw in Node.js\u0026apos;s permission model allows Unix Domain Socket connections to bypass network restrictions even without `\n7.  **CVE-2026-21637 (Medium)**: A flaw in Node.js TLS error handling allows synchronous exceptions thrown during `pskCallback` or `ALPNCallback` to bypass standard error handlers, causing process termination or file descriptor leaks.\n8.  **CVE-2025-55132 (Low)**: A flaw in Node.js\u0026apos;s permission model allows file timestamps to be changed via `fs.futimes()` even with only read permissions, potentially obscuring activity in logs.(CVE-2025-55131)\n\nA flaw in Node.js\u0026apos;s permission model allows a file\u0026apos;s access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.(CVE-2025-55132)\n\nA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on(\u0026apos;secureConnection\u0026apos;, socket =\u0026gt; {\n  socket.on(\u0026apos;error\u0026apos;, err =\u0026gt; {\n    console.log(err)\n  })\n})\n```(CVE-2025-59465)\n\nWe have identified a bug in Node.js error handling where \u0026quot;Maximum call stack size exceeded\u0026quot; errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on(\u0026apos;uncaughtException\u0026apos;)`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.(CVE-2025-59466)\n\nThis is a security vulnerability that has been assigned a CVE identifier (CVE-2026-21637). Currently, in the vulnerability information from SUSE, the title, description, and relief fields are empty, and the list of affected packages is also empty. This indicates that the detailed information of this vulnerability may still be under investigation, assignment, or in a reserved state, and specific technical details, scope of impact, and attack vectors have not been publicly disclosed. It is recommended to monitor official security advisories for subsequent updates.(CVE-2026-21637)","status":"published","published":"2026-01-23T11:10:15Z","modified":"2026-08-18T01:19:31.510346796Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1221","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.(CVE-2025-55130)\n\nNode.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include:\n1.  **CVE-2025-55131 (High)**: A flaw in Node.js\u0026apos;s buffer allocation logic can expose uninitialized memory when allocations are interrupted using the `vm` module with the `timeout` option. Buffers allocated with `Buffer.alloc` and other TypedArray instances like `Uint8Array` may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption.\n2.  **CVE-2025-55130 (High)**: A flaw in Node.js\u0026apos;s Permissions model allows attackers to bypass `\n3.  **CVE-2025-59465 (High)**: A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket error, leading to a remote denial of service.\n4.  **CVE-2025-59466 (Medium)**: A bug in Node.js error handling makes \u0026quot;Maximum call stack size exceeded\u0026quot; errors uncatchable when `async_hooks.createHook()` is enabled, causing the process to terminate unrecoverably.\n5.  **CVE-2025-59464 (Medium)**: A memory leak in Node.js\u0026apos;s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during `socket.getPeerCertificate(true)`, allowing remote memory exhaustion.\n6.  **CVE-2026-21636 (Medium)**: A flaw in Node.js\u0026apos;s permission model allows Unix Domain Socket connections to bypass network restrictions even without `\n7.  **CVE-2026-21637 (Medium)**: A flaw in Node.js TLS error handling allows synchronous exceptions thrown during `pskCallback` or `ALPNCallback` to bypass standard error handlers, causing process termination or file descriptor leaks.\n8.  **CVE-2025-55132 (Low)**: A flaw in Node.js\u0026apos;s permission model allows file timestamps to be changed via `fs.futimes()` even with only read permissions, potentially obscuring activity in logs.(CVE-2025-55131)\n\nA flaw in Node.js\u0026apos;s permission model allows a file\u0026apos;s access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.(CVE-2025-55132)\n\nA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on(\u0026apos;secureConnection\u0026apos;, socket =\u0026gt; {\n  socket.on(\u0026apos;error\u0026apos;, err =\u0026gt; {\n    console.log(err)\n  })\n})\n```(CVE-2025-59465)\n\nWe have identified a bug in Node.js error handling where \u0026quot;Maximum call stack size exceeded\u0026quot; errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on(\u0026apos;uncaughtException\u0026apos;)`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.(CVE-2025-59466)\n\nThis is a security vulnerability that has been assigned a CVE identifier (CVE-2026-21637). Currently, in the vulnerability information from SUSE, the title, description, and relief fields are empty, and the list of affected packages is also empty. This indicates that the detailed information of this vulnerability may still be under investigation, assignment, or in a reserved state, and specific technical details, scope of impact, and attack vectors have not been publicly disclosed. It is recommended to monitor official security advisories for subsequent updates.(CVE-2026-21637)","status":"published","published":"2026-01-23T11:10:15Z","modified":"2026-08-18T01:19:30.353334079Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-2820","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on(\u0026apos;secureConnection\u0026apos;, socket =\u0026gt; {\n  socket.on(\u0026apos;error\u0026apos;, err =\u0026gt; {\n    console.log(err)\n  })\n})\n```(CVE-2025-59465)\n\nA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.(CVE-2026-21637)\n\nA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\n\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.(CVE-2026-21714)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.434413271Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2821","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on(\u0026apos;secureConnection\u0026apos;, socket =\u0026gt; {\n  socket.on(\u0026apos;error\u0026apos;, err =\u0026gt; {\n    console.log(err)\n  })\n})\n```(CVE-2025-59465)\n\nA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.(CVE-2026-21637)\n\nA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\n\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.(CVE-2026-21714)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.444455044Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:1842","title":"Red Hat Security Advisory: nodejs24 security update","status":"published","published":"2026-02-06T10:08:28Z","modified":"2026-10-16T10:12:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1843","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-02-06T10:08:28Z","modified":"2026-10-16T10:12:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:2420","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-02-11T10:10:39Z","modified":"2026-10-16T10:13:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:2421","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-02-11T10:10:40Z","modified":"2026-10-16T10:13:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:2422","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2026-02-11T10:10:41Z","modified":"2026-10-16T10:13:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:2767","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2026-02-17T10:12:39Z","modified":"2026-10-16T10:14:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:2768","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2026-02-17T10:12:39Z","modified":"2026-10-16T10:14:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:2781","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-02-18T10:10:53Z","modified":"2026-10-16T10:14:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:2782","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-02-18T10:10:54Z","modified":"2026-10-16T10:14:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:2783","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2026-02-17T10:12:41Z","modified":"2026-10-16T10:14:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:2864","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-02-18T10:11:00Z","modified":"2026-10-16T10:15:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:2899","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-02-19T10:26:15Z","modified":"2026-10-16T10:15:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:6402","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:10:36Z","modified":"2026-10-16T10:22:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:6431","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:10:39Z","modified":"2026-10-16T10:22:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:7350","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-04-10T10:09:15Z","modified":"2026-10-20T10:15:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7386","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:53Z","modified":"2026-10-16T10:25:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7387","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:53Z","modified":"2026-10-16T10:25:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7670","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-04-13T10:07:20Z","modified":"2026-10-20T10:15:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7675","title":"Red Hat Security Advisory: nodejs24 security update","status":"published","published":"2026-04-13T10:07:23Z","modified":"2026-10-20T10:16:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:1842","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* nodejs: Nodejs denial of service (CVE-2025-59466)\n\n* nodejs: Nodejs denial of service (CVE-2025-59465)\n\n* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n\n* nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-06T09:08:48.331063Z","modified":"2026-02-06T09:30:06.911036Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:1843","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* nodejs: Nodejs denial of service (CVE-2025-59466)\n\n* nodejs: Nodejs denial of service (CVE-2025-59465)\n\n* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n\n* nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-06T09:08:48.331063Z","modified":"2026-02-06T09:30:06.655204Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:2420","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* nodejs: Nodejs denial of service (CVE-2025-59466)\n\n* nodejs: Nodejs denial of service (CVE-2025-59465)\n\n* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n\n* nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-11T09:10:35.64903Z","modified":"2026-02-11T09:30:10.602182Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:2421","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* nodejs: Nodejs denial of service (CVE-2025-59466)\n\n* nodejs: Nodejs denial of service (CVE-2025-59465)\n\n* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n\n* nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-11T09:10:35.64903Z","modified":"2026-02-11T09:30:11.037974Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:2422","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* nodejs: Nodejs denial of service (CVE-2025-59466)\n\n* nodejs: Nodejs denial of service (CVE-2025-59465)\n\n* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n\n* nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-11T09:10:35.64903Z","modified":"2026-02-11T09:30:10.673716Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:2781","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* nodejs: Nodejs denial of service (CVE-2025-59466)\n\n* nodejs: Nodejs denial of service (CVE-2025-59465)\n\n* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n\n* nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-18T09:05:30.043251Z","modified":"2026-02-18T09:30:30.178888Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:2782","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* nodejs: Nodejs denial of service (CVE-2025-59466)\n\n* nodejs: Nodejs denial of service (CVE-2025-59465)\n\n* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n\n* nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-18T09:05:30.043251Z","modified":"2026-02-18T09:30:29.956817Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:2783","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* nodejs: Nodejs denial of service (CVE-2025-59466)\n\n* nodejs: Nodejs denial of service (CVE-2025-59465)\n\n* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n\n* nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-18T09:05:30.043251Z","modified":"2026-02-18T09:30:29.833484Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:7350","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-10T00:04:09.070331Z","modified":"2026-04-10T00:30:06.392552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7670","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-13T06:01:13.567166Z","modified":"2026-04-13T06:30:06.733151Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7675","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-15T12:07:10.074197Z","modified":"2026-04-15T12:30:34.977687Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-21637","description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","status":"published","published":"2026-01-20T21:16:00Z","modified":"2026-05-20T16:24:09.626203786Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"ALSA-2026:1842","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * nodejs: Nodejs denial of service (CVE-2025-59466)\n  * nodejs: Nodejs denial of service (CVE-2025-59465)\n  * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n  * nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-10-29T11:30:14.984183573Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:1843","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * nodejs: Nodejs denial of service (CVE-2025-59466)\n  * nodejs: Nodejs denial of service (CVE-2025-59465)\n  * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n  * nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-10-29T11:30:15.755368932Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:2420","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * nodejs: Nodejs denial of service (CVE-2025-59466)\n  * nodejs: Nodejs denial of service (CVE-2025-59465)\n  * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n  * nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-10-29T11:02:23.775515145Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:2421","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * nodejs: Nodejs denial of service (CVE-2025-59466)\n  * nodejs: Nodejs denial of service (CVE-2025-59465)\n  * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n  * nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-10-29T11:02:23.858519002Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:2422","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * nodejs: Nodejs denial of service (CVE-2025-59466)\n  * nodejs: Nodejs denial of service (CVE-2025-59465)\n  * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n  * nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-10-29T11:02:24.030241498Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:2781","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * nodejs: Nodejs denial of service (CVE-2025-59466)\n  * nodejs: Nodejs denial of service (CVE-2025-59465)\n  * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n  * nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-17T00:00:00Z","modified":"2026-10-29T11:32:34.903102448Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:2782","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * nodejs: Nodejs denial of service (CVE-2025-59466)\n  * nodejs: Nodejs denial of service (CVE-2025-59465)\n  * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n  * nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-17T00:00:00Z","modified":"2026-10-29T11:32:34.871180285Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:2783","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * nodejs: Nodejs denial of service (CVE-2025-59466)\n  * nodejs: Nodejs denial of service (CVE-2025-59465)\n  * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)\n  * nodejs: Nodejs file permissions bypass (CVE-2025-55130)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-17T00:00:00Z","modified":"2026-10-29T11:32:34.729545316Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:7350","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-10-29T11:32:37.577752858Z","updated_at":"2026-11-02T15:27:55.200553Z"}]},"sources_more":{"osv":32}}