{"id":"CVE-2026-58041","aliases":["ALPINE-CVE-2026-58041","ALSA-2026:61377","ALSA-2026:61386","ALSA-2026:62583","BELL-CVE-2026-58041","BIT-node-2026-58041","BIT-node-min-2026-58041","DEBIAN-CVE-2026-58041","EUVD-2026-52561","GHSA-qgrj-5wc5-7xvc","RHSA-2026:48305","RHSA-2026:48537","RHSA-2026:52990","RHSA-2026:61377","RHSA-2026:61386","RHSA-2026:62583","SUSE-SU-2026:23131-1","SUSE-SU-2026:23155-1","SUSE-SU-2026:3520-1","UBUNTU-CVE-2026-58041","openSUSE-SU-2026:11439-1","openSUSE-SU-2026:11440-1","openSUSE-SU-2026:21546-1"],"status":"published","title":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync...","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00287,"percentile":0.21424,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-367"],"published":"2026-07-31T10:15:11Z","modified":"2026-11-03T06:32:58Z","exploits":[{"source":"pocgithub","id":"CompleteTech-Security/node-cve-2026-58041-check","title":"CompleteTech-Security/node-cve-2026-58041-check","date":"2026-10-23","url":"https://github.com/CompleteTech-Security/node-cve-2026-58041-check"}],"fixes":[{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["24.18.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["24.18.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["26.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["24.18.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["24.18.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["22.23.2","24.18.1","26.5.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["22.23.2","24.18.1","26.5.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["24.19.0+dfsg+~cs24.13.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.5.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.17.0-1.24.19.0.1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el9.8.0+301+084fac05"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el9.8.0+301+084fac05"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el9.8.0+301+084fac05"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el9.8.0+301+084fac05"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el9.8.0+301+084fac05"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.17.0-1.24.19.0.1.module_el9.8.0+301+084fac05"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.19.0.1.module_el9.8.0+301+084fac05"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el8.10.0+4268+8e07aa5a"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el8.10.0+4268+8e07aa5a"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el8.10.0+4268+8e07aa5a"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el8.10.0+4268+8e07aa5a"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module_el8.10.0+4268+8e07aa5a"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.17.0-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a"}]}],"bundled":11},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"24.18.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"24.18.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.2"},{"introduced":"23.0.0"},{"fixed":"24.18.1"},{"introduced":"25.0.0"},{"fixed":"26.5.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.2"},{"introduced":"23.0.0"},{"fixed":"24.18.1"},{"introduced":"25.0.0"},{"fixed":"26.5.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.19.0+dfsg+~cs24.13.3-1"}]}],"versions":["20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.2-2.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.2-2.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.2-2.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.2-2.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.2-2.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.2-2.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.8-1.22.23.2.2.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.2-2.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.1.0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.26.7.0.1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.7.0.1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.17.0-1.24.19.0.1.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.17.0-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.19.0-1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.17.0-1.24.19.0.1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.19.0.1.module+el8.10.0+24711+b610b202"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-160000.1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-160000.1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-160000.1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-160000.1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-150700.15.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2","0.10.25~dfsg2-2ubuntu1.2+esm1","0.10.25~dfsg2-2ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2","10.19.0~dfsg-3ubuntu1.3","10.19.0~dfsg-3ubuntu1.5","10.19.0~dfsg-3ubuntu1.6","10.19.0~dfsg-3ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.22.1+dfsg+~cs22.19.15-1ubuntu1","24.16.0+dfsg+~cs24.13.1-2ubuntu1","24.18.0+dfsg+~cs24.13.2-1ubuntu1","24.19.0+dfsg+~cs24.13.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-4","22.21.1+dfsg+~cs22.19.0-6ubuntu4","22.22.0+dfsg+~cs22.19.6-1ubuntu2","22.22.0+dfsg+~cs22.19.13-2ubuntu1","22.22.1+dfsg+~cs22.19.15-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.5.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-160000.1.1"}]}],"bundled":12}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58041","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qgrj-5wc5-7xvc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-58041","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61377","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56846","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56848","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58043","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509171","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510856","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-61377.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-56847.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-56850.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-58039.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-58040.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-58041.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-58042.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-58044.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-58045.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61386","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61386.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62583","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-62583.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-58041","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-58041","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48305","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56847","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56850","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58040","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58039","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58044","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58042","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58041","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48305.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56846","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56847","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509179","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56850","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56850","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58039","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58040","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58041","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510854","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58042","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509171","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58043","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58044","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58045","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48537","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16729","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15157","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14643","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16728","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48537.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13697","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14643","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15157","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16728","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508506","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16729","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52990","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52990.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["article"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511089","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-220543","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61377.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56848","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56848","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61386.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62583.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623131-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272882","tags":["report"]},{"url":"https://bugzilla.suse.com/1272941","tags":["report"]},{"url":"https://bugzilla.suse.com/1272942","tags":["report"]},{"url":"https://bugzilla.suse.com/1272943","tags":["report"]},{"url":"https://bugzilla.suse.com/1272944","tags":["report"]},{"url":"https://bugzilla.suse.com/1272945","tags":["report"]},{"url":"https://bugzilla.suse.com/1272946","tags":["report"]},{"url":"https://bugzilla.suse.com/1272947","tags":["report"]},{"url":"https://bugzilla.suse.com/1272948","tags":["report"]},{"url":"https://bugzilla.suse.com/1272949","tags":["report"]},{"url":"https://bugzilla.suse.com/1272950","tags":["report"]},{"url":"https://bugzilla.suse.com/1272951","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58045","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623155-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263520-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268097","tags":["report"]},{"url":"https://bugzilla.suse.com/1269825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58041","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodesqlite-sqltagstore-iterator-replay-can-re-execute-writes-cve-2026-58041---medium","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-58041","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-04T00:49:58.112Z","modified":"2026-08-04T15:04:06.975Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-52561","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-04T00:49:58Z","modified":"2026-08-04T15:04:06Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:22.965583Z"}],"ghsa":[{"id":"GHSA-qgrj-5wc5-7xvc","title":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync...","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-04T03:31:10Z","modified":"2026-08-04T03:31:16Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:10:03.433591Z"}],"nvd":[{"id":"CVE-2026-58041","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-04T01:16:19.987Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:12:34.643497Z"}],"osv":[{"id":"ALPINE-CVE-2026-58041","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-04T01:16:19.987Z","modified":"2026-11-03T06:32:58.153507261Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2026-58041","status":"published","published":"2026-08-01T06:05:22.36882Z","modified":"2026-08-05T07:15:05.379544823Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"DEBIAN-CVE-2026-58041","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\r \r This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-04T01:16:19.987Z","modified":"2026-10-24T09:47:29.89929584Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"RHSA-2026:48305","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:11Z","modified":"2026-10-20T10:10:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48537","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:12Z","modified":"2026-10-20T10:10:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:52990","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-11T10:12:09Z","modified":"2026-10-20T10:10:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:61377","title":"Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update","status":"published","published":"2026-09-01T10:28:23Z","modified":"2026-10-20T10:43:34.61649497Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61386","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-09-01T10:28:25Z","modified":"2026-10-20T10:12:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62583","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-09-03T10:14:31Z","modified":"2026-10-20T10:12:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-58041","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-04T01:16:00Z","modified":"2026-10-17T12:59:13.160103154Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:61377","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)\n  * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)\n  * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:42:23.343793762Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:61386","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)\n  * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)\n  * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:42:20.660787602Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:62583","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)\n  * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)\n  * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-10-29T11:12:09.640556968Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"BIT-node-2026-58041","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-17T05:52:30.746Z","modified":"2026-08-17T08:11:02.5076681Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2026-58041","description":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.","status":"published","published":"2026-08-17T05:52:38.771Z","modified":"2026-08-17T08:11:02.5076681Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"openSUSE-SU-2026:11439-1","title":"corepack24-24.18.1-1.1 on GA media","description":"These are all security issues fixed in the corepack24-24.18.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-03T00:00:00Z","modified":"2026-08-04T11:45:05.039586582Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11440-1","title":"nodejs26-26.5.1-1.1 on GA media","description":"These are all security issues fixed in the nodejs26-26.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-03T00:00:00Z","modified":"2026-08-04T11:45:06.41142607Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21546-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues:\n\nUpdate to 24.18.1.\n\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).\n","status":"published","published":"2026-08-10T09:28:21Z","modified":"2026-08-12T18:23:41.522498755Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23131-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues:\n\nUpdate to 24.18.1.\n\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).\n","status":"published","published":"2026-08-10T08:46:10Z","modified":"2026-08-14T18:23:45.476813025Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23155-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues:\n\nUpdate to 24.18.1.\n\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).\n","status":"published","published":"2026-08-10T08:46:10Z","modified":"2026-08-14T18:23:42.295271168Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3520-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues:\n\nUpdate to 24.18.1.\n\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58041: `node:sqlite` `SQLTagStore` iterator replay can re-execute writes (bsc#1272946).  \n- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).\n\nOther updates and bugfixes:\n\n- Version 24.18.0:\n  * fix: severe regression in security update 24.17 of nodejs24 (bsc#1269825)\n  * doc: update blockList stability status to release candidate\n  * fs: support caller-supplied readFile() buffers\n  * http: close pre-request sockets in closeIdleConnections\n  * loader: implement package maps\n  * net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive\n  * tls: add certificateCompression option\n  * vfs: dispatch node:fs/promises to mounted VFS instances\n  * vfs: add minimal node:vfs subsystem\n","status":"published","published":"2026-08-06T11:31:16Z","modified":"2026-08-07T10:00:45.115558826Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}