{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-advisor-frontend-rhel9 container image is now generally available in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.  When you install Red Hat Lightspeed in Satellite locally,  you can generate Red Hat Lightspeed recommendations without  sending system data to Red Hat services. ",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:51342",
        "url": "https://access.redhat.com/errata/RHSA-2026:51342"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51342.json"
      }
    ],
    "title": "Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image",
    "tracking": {
      "current_release_date": "2026-08-23T16:52:16+00:00",
      "generator": {
        "date": "2026-08-23T16:52:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:51342",
      "initial_release_date": "2026-08-06T20:11:23+00:00",
      "revision_history": [
        {
          "date": "2026-08-06T20:11:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T16:52:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18",
                "product": {
                  "name": "Red Hat Satellite 6.18",
                  "product_id": "Red Hat Satellite 6.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-advisor-frontend-rhel9@sha256%3A651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-advisor-frontend-rhel9\u0026tag=1785776190"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64 as a component of Red Hat Satellite 6.18",
          "product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:11:23+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51342"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:11:23+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51342"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:651e258b90232998259df9280aa286c5394d5b1f859df75ef69b168cd9ccbea3_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-vulnerability-frontend-rhel9 container image is now available as a technical preview in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:51348",
        "url": "https://access.redhat.com/errata/RHSA-2026:51348"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45822",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45822"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51348.json"
      }
    ],
    "title": "Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image",
    "tracking": {
      "current_release_date": "2026-08-23T16:52:02+00:00",
      "generator": {
        "date": "2026-08-23T16:52:02+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:51348",
      "initial_release_date": "2026-08-06T20:12:30+00:00",
      "revision_history": [
        {
          "date": "2026-08-06T20:12:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T16:52:02+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18",
                "product": {
                  "name": "Red Hat Satellite 6.18",
                  "product_id": "Red Hat Satellite 6.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-vulnerability-frontend-rhel9@sha256%3A8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9\u0026tag=1785762027"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64 as a component of Red Hat Satellite 6.18",
          "product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:30+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51348"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:30+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51348"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-45822",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-30T09:01:06.468966+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494807"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "decode-uri-component: decode-uri-component: Denial of Service via crafted input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service flaw was found in the decode-uri-component npm package. The decode() function exhibits super-linear time complexity when processing input containing many percent-encoded sequences, allowing an attacker to cause significant CPU consumption and event-loop blocking. In Red Hat products where this package is bundled (OpenShift Console, Quay, Pipelines, RHOAI, and others), exploitation requires that attacker-controlled input containing crafted percent-encoded strings reaches the decode() function without prior length validation. Red Hat rates this as Moderate severity since the impact is limited to availability with no confidentiality or integrity impact, consistent with the CNA\u0027s CVSS 4.0 assessment of 6.6 Medium.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494807",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494807"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js",
          "url": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js"
        },
        {
          "category": "external",
          "summary": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005",
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/decode-uri-component",
          "url": "https://www.npmjs.com/package/decode-uri-component"
        }
      ],
      "release_date": "2026-06-30T08:05:36.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:30+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51348"
        },
        {
          "category": "workaround",
          "details": "Validate and limit the length of any user-controlled input before passing it to decode-uri-component\u0027s decode() function. Inputs containing more than approximately 200 percent-encoded tokens (e.g. \u0027%ab\u0027 sequences) can trigger noticeable delays. Reject or truncate URI components exceeding a reasonable length threshold before decoding. A fix exists in the upstream repository (commit fa479daf) but has not yet been included in an npm release.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:8c394a8b4021570c1420c1bec34061741603ff95b8b2a4378bab902396c32954_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "decode-uri-component: decode-uri-component: Denial of Service via crafted input"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-host-inventory-frontend-rhel9 container image is now generally available in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.  When you install Red Hat Lightspeed in Satellite locally,  you can generate Red Hat Lightspeed recommendations without  sending system data to Red Hat services. ",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:51349",
        "url": "https://access.redhat.com/errata/RHSA-2026:51349"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25128",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25128"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25896",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25896"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-26278",
        "url": "https://access.redhat.com/security/cve/CVE-2026-26278"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-26996",
        "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27904",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27942",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27942"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33036",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33036"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44990",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44990"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51349.json"
      }
    ],
    "title": "Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image",
    "tracking": {
      "current_release_date": "2026-08-23T16:52:11+00:00",
      "generator": {
        "date": "2026-08-23T16:52:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:51349",
      "initial_release_date": "2026-08-06T20:12:40+00:00",
      "revision_history": [
        {
          "date": "2026-08-06T20:12:40+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T16:52:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18",
                "product": {
                  "name": "Red Hat Satellite 6.18",
                  "product_id": "Red Hat Satellite 6.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-host-inventory-frontend-rhel9@sha256%3Aa1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9\u0026tag=1785922764"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64 as a component of Red Hat Satellite 6.18",
          "product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-25128",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-01-30T16:01:27.320561+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2435497"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw has been discovered in the fast-xml-parser npm library. In fast-xml-parser, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The availability impact of this flaw is limited to the application which bundles the fast-xml-parser library. Red Hat host systems are not at risk of availability impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25128"
        },
        {
          "category": "external",
          "summary": "RHBZ#2435497",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435497"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25128",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25128"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25128",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25128"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh"
        }
      ],
      "release_date": "2026-01-30T15:14:58.244000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug"
    },
    {
      "cve": "CVE-2026-25896",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-02-20T22:01:59.622413+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441501"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted XML input. The system incorrectly interprets a dot in a DOCTYPE entity name as a regular expression wildcard during processing. This allows the attacker to bypass security measures and inject malicious scripts, resulting in Cross-Site Scripting (XSS) when the parsed output is displayed to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has been assessed as IMPORTANT for Red Hat products. This vulnerability arises when the parsed XML output is subsequently rendered to users which requires the interaction of the user. The impact of this flaw is also limited to the user\u0027s browser context.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25896"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441501",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441501"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25896",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25896"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25896",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25896"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2"
        }
      ],
      "release_date": "2026-02-20T20:57:48.074000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling"
    },
    {
      "cve": "CVE-2026-26278",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-02-19T21:03:33.363864+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted, small XML input. This input can force the XML parser to perform an unlimited amount of entity expansion, consuming excessive resources. This can lead to the application freezing for an extended period, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26278"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26278",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26278"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26278",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26278"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj"
        }
      ],
      "release_date": "2026-02-19T19:40:55.842000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27904",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-26T02:01:23.004531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442922"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442922",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "release_date": "2026-02-26T01:07:42.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    },
    {
      "cve": "CVE-2026-27942",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-02-26T03:01:53.367202+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442938"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-xml-parser. A user can exploit this flaw by processing specially crafted XML data with the XML builder when the `preserveOrder` option is enabled. This can lead to a stack overflow, causing the application to crash and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The flaw affects the XML builder component of the fast-xml-parser library and is triggered only when the preserveOrder option is explicitly enabled. In Red Hat\u2013shipped configurations, this option is not enabled by default, and the vulnerable code path is therefore not exercised under typical deployments.\nThe underlying issue results in uncontrolled recursion leading to a stack overflow condition, which causes the application to terminate unexpectedly. While this can be triggered via crafted input, the impact is limited strictly to denial of service (DoS) and does not provide a mechanism for arbitrary code execution, privilege escalation, or data disclosure.\nFurthermore, exploitation requires that the affected application processes attacker-controlled XML input through the XML builder functionality with the specific vulnerable configuration enabled. This significantly reduces the attack surface and introduces environmental constraints not considered in the generalized NVD scoring.\n\nGiven the absence of confidentiality and integrity impact, the requirement for non-default configuration, and the limitation of the impact to process termination, Red Hat considers the practical risk to be lower than the NVD assessment. As such, this issue is classified as Moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27942"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442938",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442938"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27942",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27942"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27942",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27942"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/pull/791",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/pull/791"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3"
        }
      ],
      "release_date": "2026-02-26T01:22:11.383000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, configure applications using the `fast-xml-parser` XML builder to set the `preserveOrder` option to `false`. Alternatively, ensure that all XML input data is thoroughly validated before being passed to the builder to prevent the processing of malicious or malformed content.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service"
    },
    {
      "cve": "CVE-2026-33036",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-03-20T06:02:18.306021+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449458"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by supplying specially crafted XML input containing numeric character references or standard XML entities. This input can bypass configured entity expansion limits, leading to excessive memory allocation and high CPU usage. The primary consequence is a Denial of Service (DoS), which can crash the affected process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33036"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449458",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449458"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33036",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33036"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33036",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33036"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r"
        }
      ],
      "release_date": "2026-03-20T05:17:03.290000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass"
    },
    {
      "cve": "CVE-2026-44990",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-06-12T21:02:24.911971+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488565"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. The `sanitize-html` library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed `xmp` element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488565",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44990",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
        }
      ],
      "release_date": "2026-06-12T20:39:47.065000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T20:12:40+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51349"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9@sha256:a1d343700722a13d9c7ff7b23e8e770fdbe4fdd7c55bbf4d7f4cb4bf28cafc0d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nodejs-nodemon is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Simple monitor script for use during development of a node.js app.  For use during development of a node.js based application.  nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application.  nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word \"node\" on the command line when you run your script.\n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:52394",
        "url": "https://access.redhat.com/errata/RHSA-2026:52394"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2494813",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52394.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs-nodemon security update",
    "tracking": {
      "current_release_date": "2026-08-23T11:50:39+00:00",
      "generator": {
        "date": "2026-08-23T11:50:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:52394",
      "initial_release_date": "2026-08-10T01:38:27+00:00",
      "revision_history": [
        {
          "date": "2026-08-10T01:38:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-10T01:38:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T11:50:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                  "product_id": "AppStream-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.1.14-2.el10_0.noarch",
                "product": {
                  "name": "nodejs-nodemon-0:3.1.14-2.el10_0.noarch",
                  "product_id": "nodejs-nodemon-0:3.1.14-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-2.el10_0?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.1.14-2.el10_0.src",
                "product": {
                  "name": "nodejs-nodemon-0:3.1.14-2.el10_0.src",
                  "product_id": "nodejs-nodemon-0:3.1.14-2.el10_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-2.el10_0?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.1.14-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.noarch"
        },
        "product_reference": "nodejs-nodemon-0:3.1.14-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.1.14-2.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.src"
        },
        "product_reference": "nodejs-nodemon-0:3.1.14-2.el10_0.src",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T01:38:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52394"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-nodemon-0:3.1.14-2.el10_0.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)\n\n* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)\n\n* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)\n\n* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)\n\n* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n\n* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:52399",
        "url": "https://access.redhat.com/errata/RHSA-2026:52399"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2476810",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476810"
      },
      {
        "category": "external",
        "summary": "2489980",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
      },
      {
        "category": "external",
        "summary": "2493331",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
      },
      {
        "category": "external",
        "summary": "2493335",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"
      },
      {
        "category": "external",
        "summary": "2493337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
      },
      {
        "category": "external",
        "summary": "2494813",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
      },
      {
        "category": "external",
        "summary": "2498116",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
      },
      {
        "category": "external",
        "summary": "2498120",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52399.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:22 security update",
    "tracking": {
      "current_release_date": "2026-08-23T11:50:40+00:00",
      "generator": {
        "date": "2026-08-23T11:50:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:52399",
      "initial_release_date": "2026-08-10T02:56:38+00:00",
      "revision_history": [
        {
          "date": "2026-08-10T02:56:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-10T02:56:38+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T11:50:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                  "product_id": "AppStream-9.6.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=src\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
                "product": {
                  "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src (nodejs:22)",
                  "product_id": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-1.module%2Bel9.6.0%2B24604%2B449f851b?arch=src\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src (nodejs:22)",
                  "product_id": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.6.0%2B23473%2B45664c2d?arch=src\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch (nodejs:22)",
                  "product_id": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch (nodejs:22)",
                  "product_id": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-1.module%2Bel9.6.0%2B24604%2B449f851b?arch=noarch\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch (nodejs:22)",
                  "product_id": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.6.0%2B23473%2B45664c2d?arch=noarch\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch (nodejs:22)",
                  "product_id": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-4.module%2Bel9.6.0%2B23473%2B45664c2d?arch=noarch\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.8-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=3\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.8-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=3\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.8-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=3\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.8-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=3\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22"
        },
        "product_reference": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22"
        },
        "product_reference": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22"
        },
        "product_reference": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22"
        },
        "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22"
        },
        "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22"
        },
        "product_reference": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12151",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-17T17:01:45.297604+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2489980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in the `undici` WebSocket client allows a remote attacker to cause unbounded memory growth. By sending numerous small or empty WebSocket frames, an unauthenticated attacker can exhaust system memory, leading to a denial of service in Red Hat products that use the affected client.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "RHBZ#2489980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q"
        }
      ],
      "release_date": "2026-06-17T16:05:38.785000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames"
    },
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-42338",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-12T21:01:14.436876+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476810"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by providing untrusted input to the Address6 constructor. When an application renders the output of Address6.group(), Address6.link(), or the AddressError.parseMessage as HTML without proper escaping, the attacker-controlled content can be executed in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in the `ip-address` JavaScript library is rated as Important. It allows for cross-site scripting (XSS) when an application processes untrusted input through the `Address6` constructor and subsequently renders the unescaped output of methods like `Address6.group()`, `Address6.link()`, or `AddressError.parseMessage` directly as HTML. While the library itself is affected, exploitation is contingent on specific application-level rendering practices that may not be common in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42338"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476810",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476810"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42338",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42338"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42338",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42338"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g"
        }
      ],
      "release_date": "2026-05-12T19:43:16.470000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input"
    },
    {
      "cve": "CVE-2026-48615",
      "cwe": {
        "id": "CWE-209",
        "name": "Generation of Error Message Containing Sensitive Information"
      },
      "discovery_date": "2026-06-26T02:01:59.112093+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate-impact information disclosure flaw in Node.js allows proxy credentials to be exposed in `ERR_PROXY_TUNNEL` error messages. In Red Hat environments, if Node.js applications are configured to embed proxy credentials directly within the proxy URL, these sensitive details could be inadvertently captured by system logs or other error monitoring tools during proxy tunnel error handling.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48615",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48615",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.524000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling"
    },
    {
      "cve": "CVE-2026-48618",
      "cwe": {
        "id": "CWE-289",
        "name": "Authentication Bypass by Alternate Name"
      },
      "discovery_date": "2026-06-26T02:02:10.741725+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js allows for a TLS wildcard-depth authentication bypass due to a mismatch in how hostnames and unicode dot separators are handled during authentication. This could enable an attacker to circumvent security boundaries, potentially leading to unauthorized access and compromise of sensitive information in applications utilizing Node.js for TLS connections. The issue affects Node.js versions 22, 24, and 26 as shipped in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48618",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.868000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch"
    },
    {
      "cve": "CVE-2026-48933",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-26T02:01:39.107538+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493331"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Node.js WebCrypto, as a remote attacker can crash the Node.js process by providing a specially crafted large input to the `subtle.encrypt()` function. This could lead to service unavailability in Red Hat environments where Node.js applications process untrusted data with WebCrypto.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493331",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48933",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48933",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.823000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()"
    },
    {
      "cve": "CVE-2026-59873",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-08T16:01:31.576716+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: node-tar: Denial of Service via crafted gzip bomb",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library\u0027s archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
          "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
        }
      ],
      "release_date": "2026-07-08T15:22:40.077000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "cve": "CVE-2026-59874",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:09.952291+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: Node-tar: Denial of Service via malformed tar archive header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5",
          "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
        }
      ],
      "release_date": "2026-07-08T15:23:47.527000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    }
  ]
}