Vulnerability-Lookup

RHSA-2026:52399

Vulnerability from csaf_redhat - Published: 2026-08-10 02:56 - Updated: 2026-08-10 22:01

Summary

Red Hat Security Advisory: nodejs:22 security update

Severity

Important

Notes

Topic: An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-12151

A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 43 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-13149

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 43 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-42338

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by providing untrusted input to the Address6 constructor. When an application renders the output of Address6.group(), Address6.link(), or the AddressError.parseMessage as HTML without proper escaping, the attacker-controlled content can be executed in the user's browser.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 43 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-48615

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.

5.9 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-209 - Generation of Error Message Containing Sensitive Information

Affected products

Fixed 43 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-48618

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.

7.7 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE-289 - Authentication Bypass by Alternate Name

Affected products

Fixed 43 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-48933

A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 43 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-59873

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 43 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-59874

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 43 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22	—	Vendor Fix fix Workaround

Threats

Impact Important

References

55 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:52399	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476810	external
https://bugzilla.redhat.com/show_bug.cgi?id=2489980	external
https://bugzilla.redhat.com/show_bug.cgi?id=2493331	external
https://bugzilla.redhat.com/show_bug.cgi?id=2493335	external
https://bugzilla.redhat.com/show_bug.cgi?id=2493337	external
https://bugzilla.redhat.com/show_bug.cgi?id=2494813	external
https://bugzilla.redhat.com/show_bug.cgi?id=2498116	external
https://bugzilla.redhat.com/show_bug.cgi?id=2498120	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-12151	self
https://bugzilla.redhat.com/show_bug.cgi?id=2489980	external
https://www.cve.org/CVERecord?id=CVE-2026-12151	external
https://nvd.nist.gov/vuln/detail/CVE-2026-12151	external
https://cna.openjsf.org/security-advisories.html	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-13149	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494813	external
https://www.cve.org/CVERecord?id=CVE-2026-13149	external
https://nvd.nist.gov/vuln/detail/CVE-2026-13149	external
https://github.com/juliangruber/brace-expansion/c…	external
https://www.npmjs.com/package/brace-expansion	external
https://access.redhat.com/security/cve/CVE-2026-42338	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476810	external
https://www.cve.org/CVERecord?id=CVE-2026-42338	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42338	external
https://github.com/beaugunderson/ip-address/secur…	external
https://access.redhat.com/security/cve/CVE-2026-48615	self
https://bugzilla.redhat.com/show_bug.cgi?id=2493335	external
https://www.cve.org/CVERecord?id=CVE-2026-48615	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48615	external
https://nodejs.org/en/blog/vulnerability/june-202…	external
https://access.redhat.com/security/cve/CVE-2026-48618	self
https://bugzilla.redhat.com/show_bug.cgi?id=2493337	external
https://www.cve.org/CVERecord?id=CVE-2026-48618	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48618	external
https://access.redhat.com/security/cve/CVE-2026-48933	self
https://bugzilla.redhat.com/show_bug.cgi?id=2493331	external
https://www.cve.org/CVERecord?id=CVE-2026-48933	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48933	external
https://access.redhat.com/security/cve/CVE-2026-59873	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498120	external
https://www.cve.org/CVERecord?id=CVE-2026-59873	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59873	external
https://github.com/isaacs/node-tar/commit/2812e93…	external
https://github.com/isaacs/node-tar/releases/tag/v7.5.19	external
https://github.com/isaacs/node-tar/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-59874	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498116	external
https://www.cve.org/CVERecord?id=CVE-2026-59874	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59874	external
https://github.com/isaacs/node-tar/commit/9e78bf0…	external
https://github.com/isaacs/node-tar/releases/tag/v7.5.18	external
https://github.com/isaacs/node-tar/security/advis…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)\n\n* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)\n\n* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)\n\n* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)\n\n* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n\n* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:52399",
        "url": "https://access.redhat.com/errata/RHSA-2026:52399"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2476810",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476810"
      },
      {
        "category": "external",
        "summary": "2489980",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
      },
      {
        "category": "external",
        "summary": "2493331",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
      },
      {
        "category": "external",
        "summary": "2493335",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"
      },
      {
        "category": "external",
        "summary": "2493337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
      },
      {
        "category": "external",
        "summary": "2494813",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
      },
      {
        "category": "external",
        "summary": "2498116",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
      },
      {
        "category": "external",
        "summary": "2498120",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52399.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:22 security update",
    "tracking": {
      "current_release_date": "2026-08-10T22:01:16+00:00",
      "generator": {
        "date": "2026-08-10T22:01:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.14"
        }
      },
      "id": "RHSA-2026:52399",
      "initial_release_date": "2026-08-10T02:56:38+00:00",
      "revision_history": [
        {
          "date": "2026-08-10T02:56:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-10T02:56:38+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-10T22:01:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                  "product_id": "AppStream-9.6.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=src\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
                "product": {
                  "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src (nodejs:22)",
                  "product_id": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-1.module%2Bel9.6.0%2B24604%2B449f851b?arch=src\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src (nodejs:22)",
                  "product_id": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.6.0%2B23473%2B45664c2d?arch=src\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch (nodejs:22)",
                  "product_id": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch (nodejs:22)",
                  "product_id": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-1.module%2Bel9.6.0%2B24604%2B449f851b?arch=noarch\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch (nodejs:22)",
                  "product_id": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.6.0%2B23473%2B45664c2d?arch=noarch\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch (nodejs:22)",
                  "product_id": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-4.module%2Bel9.6.0%2B23473%2B45664c2d?arch=noarch\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.8-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=aarch64\u0026epoch=3\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.8-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=ppc64le\u0026epoch=3\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.8-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=s390x\u0026epoch=3\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.1-2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.8-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module%2Bel9.6.0%2B24604%2B449f851b?arch=x86_64\u0026epoch=3\u0026rpmmod=nodejs:22:9060020260804140259:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22"
        },
        "product_reference": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22"
        },
        "product_reference": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22"
        },
        "product_reference": "nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22"
        },
        "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22"
        },
        "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22"
        },
        "product_reference": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12151",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-17T17:01:45.297604+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2489980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in the `undici` WebSocket client allows a remote attacker to cause unbounded memory growth. By sending numerous small or empty WebSocket frames, an unauthenticated attacker can exhaust system memory, leading to a denial of service in Red Hat products that use the affected client.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "RHBZ#2489980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q"
        }
      ],
      "release_date": "2026-06-17T16:05:38.785000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames"
    },
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-42338",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-12T21:01:14.436876+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476810"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by providing untrusted input to the Address6 constructor. When an application renders the output of Address6.group(), Address6.link(), or the AddressError.parseMessage as HTML without proper escaping, the attacker-controlled content can be executed in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in the `ip-address` JavaScript library is rated as Important. It allows for cross-site scripting (XSS) when an application processes untrusted input through the `Address6` constructor and subsequently renders the unescaped output of methods like `Address6.group()`, `Address6.link()`, or `AddressError.parseMessage` directly as HTML. While the library itself is affected, exploitation is contingent on specific application-level rendering practices that may not be common in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42338"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476810",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476810"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42338",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42338"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42338",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42338"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g"
        }
      ],
      "release_date": "2026-05-12T19:43:16.470000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input"
    },
    {
      "cve": "CVE-2026-48615",
      "cwe": {
        "id": "CWE-209",
        "name": "Generation of Error Message Containing Sensitive Information"
      },
      "discovery_date": "2026-06-26T02:01:59.112093+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate-impact information disclosure flaw in Node.js allows proxy credentials to be exposed in `ERR_PROXY_TUNNEL` error messages. In Red Hat environments, if Node.js applications are configured to embed proxy credentials directly within the proxy URL, these sensitive details could be inadvertently captured by system logs or other error monitoring tools during proxy tunnel error handling.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48615",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48615",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.524000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling"
    },
    {
      "cve": "CVE-2026-48618",
      "cwe": {
        "id": "CWE-289",
        "name": "Authentication Bypass by Alternate Name"
      },
      "discovery_date": "2026-06-26T02:02:10.741725+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js allows for a TLS wildcard-depth authentication bypass due to a mismatch in how hostnames and unicode dot separators are handled during authentication. This could enable an attacker to circumvent security boundaries, potentially leading to unauthorized access and compromise of sensitive information in applications utilizing Node.js for TLS connections. The issue affects Node.js versions 22, 24, and 26 as shipped in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48618",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.868000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch"
    },
    {
      "cve": "CVE-2026-48933",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-26T02:01:39.107538+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493331"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Node.js WebCrypto, as a remote attacker can crash the Node.js process by providing a specially crafted large input to the `subtle.encrypt()` function. This could lead to service unavailability in Red Hat environments where Node.js applications process untrusted data with WebCrypto.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493331",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48933",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48933",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.823000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()"
    },
    {
      "cve": "CVE-2026-59873",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-08T16:01:31.576716+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: node-tar: Denial of Service via crafted gzip bomb",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library\u0027s archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
          "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
        }
      ],
      "release_date": "2026-07-08T15:22:40.077000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "cve": "CVE-2026-59874",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:09.952291+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: Node-tar: Denial of Service via malformed tar archive header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
          "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5",
          "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
        }
      ],
      "release_date": "2026-07-08T15:23:47.527000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-10T02:56:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:52399"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-libs-debuginfo-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.1.14-1.module+el9.6.0+24604+449f851b.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23473+45664c2d.src::nodejs:22",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23473+45664c2d.noarch::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.s390x::nodejs:22",
            "AppStream-9.6.0.Z.EUS:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    }
  ]
}

CVE-2026-12151 (GCVE-0-2026-12151)

Vulnerability from cvelistv5 – Published: 2026-06-17 16:05 – Updated: 2026-08-10 12:05

Title

undici WebSocket client vulnerable to denial of service via fragment count bypass

Summary

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

openjs

References

23 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html
https://access.redhat.com/security/cve/CVE-2026-12151	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2489980	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:48151	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39246	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35841	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41947	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39868	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52399	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35892	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35891	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34342	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41929	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38236	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38009	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36621	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47728	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:48124	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36820	vendor-advisoryx_refsource_REDHAT

Impacted products

40 products

Vendor	Product	Version
undici	undici	Affected: 0 , < 6.26.0 (semver) Unaffected: 6.26.0 (semver) Affected: 7.0.0 , < 7.28.0 (semver) Unaffected: 7.28.0 (semver) Affected: 8.0.0 , < 8.5.0 (semver) Unaffected: 8.5.0 (semver)
Red Hat	Cryostat 4 on RHEL 9	Unaffected: 4.2.0-13 , < * (rpm) cpe:/a:redhat:cryostat:4::el9
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:24.18.0-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:22.23.1-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:22.23.1-2.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260630152626.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260703140402.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626074955.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626075442.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782840519 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839981 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839193 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782838753 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839279 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782840539 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782841925 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782844225 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839658 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782838476 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839996 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839494 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Red Hat Developer Hub 1.10	Unaffected: 1783448184 , < * (rpm) cpe:/a:redhat:rhdh:1.10::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1784210921 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Hardened Images	Unaffected: 26.5.0-1.3.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 24.18.0-0.3.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 1783306396 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 1784744859 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782498792 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1783007534 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782989367 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1785245777 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat Build of Podman Desktop	cpe:/a:redhat:podman_desktop:1
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Self-service automation portal 2	cpe:/a:redhat:ansible_portal:2

Credits

lpinca Nadav0077 UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T17:29:57.305732Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T17:30:13.782Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-grafana-dashboard-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:24.18.0-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260630152626.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260703140402.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626074955.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626075442.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782840519",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839981",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839193",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782838753",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839279",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782840539",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782841925",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782844225",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839658",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782838476",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839996",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839494",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783448184",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784210921",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.5.0-1.3.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "24.18.0-0.3.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783306396",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784744859",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/dashboard-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782498792",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783007534",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989367",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/code-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785245777",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat-openshift-console-plugin-npm",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "undici",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-pf5-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "undici",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-podman-desktop.git",
            "product": "Red Hat Build of Podman Desktop",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs25",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rust",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-dashboard-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-automl-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-autorag-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-maas-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-mod-arch-mlflow-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-console-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/automation-portal",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-17T16:05:38.785Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T12:05:41.962Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-12151"
          },
          {
            "name": "RHBZ#2489980",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12151.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:48151"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39246"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35842"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35841"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41947"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39868"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52399"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35892"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35891"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34342"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41929"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38236"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38009"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36621"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47728"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:48124"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:48151: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39246: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35842: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35841: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41947: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39868: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52399: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35892: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35891: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41929: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38236: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38009: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36621: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47728: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:48124: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-17T17:01:45.297Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-17T16:05:38.785Z",
            "value": "Made public."
          }
        ],
        "title": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.26.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.26.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.28.0",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.28.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "lpinca"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Nadav0077"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches:\u0026nbsp;Upgrade to undici \u0026gt;= 6.26.0, \u0026gt;= 7.28.0, or \u0026gt;= 8.5.0.\u0026nbsp;Workarounds:\nNo workaround is available. The fix must be applied through an upgrade."
            }
          ],
          "value": "Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches:\u00a0Upgrade to undici \u003e= 6.26.0, \u003e= 7.28.0, or \u003e= 8.5.0.\u00a0Workarounds:\nNo workaround is available. The fix must be applied through an upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T16:05:38.785Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici WebSocket client vulnerable to denial of service via fragment count bypass",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-12151",
    "datePublished": "2026-06-17T16:05:38.785Z",
    "dateReserved": "2026-06-12T18:14:04.454Z",
    "dateUpdated": "2026-08-10T12:05:41.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-13149 (GCVE-0-2026-13149)

Vulnerability from cvelistv5 – Published: 2026-06-30 08:30 – Updated: 2026-07-08 11:38

Summary

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-407 - Inefficient Algorithmic Complexity

Assigner

seal

References

2 references

URL	Tags
https://github.com/juliangruber/brace-expansion/c…
https://www.npmjs.com/package/brace-expansion

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: 0 , ≤ 5.0.6 (semver)

Credits

bnbdr

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T12:43:12.568372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:43:23.029Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://registry.npmjs.org",
          "defaultStatus": "unaffected",
          "packageName": "brace-expansion",
          "product": "brace-expansion",
          "repo": "https://github.com/juliangruber/brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "lessThanOrEqual": "5.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bnbdr"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding \u0027{}\u0027 brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work."
            }
          ],
          "value": "brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding \u0027{}\u0027 brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-469",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-469 HTTP DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-407",
              "description": "CWE-407 Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T11:38:35.974Z",
        "orgId": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
        "shortName": "seal"
      },
      "references": [
        {
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
    "assignerShortName": "seal",
    "cveId": "CVE-2026-13149",
    "datePublished": "2026-06-30T08:30:34.502Z",
    "dateReserved": "2026-06-24T10:17:07.027Z",
    "dateUpdated": "2026-07-08T11:38:35.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42338 (GCVE-0-2026-42338)

Vulnerability from cvelistv5 – Published: 2026-05-12 19:43 – Updated: 2026-08-10 12:05

Title

ip-address: XSS in Address6 HTML-emitting methods

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

26 references

URL	Tags
https://github.com/beaugunderson/ip-address/secur…	x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2026-42338	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2476810	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:39246	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35841	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41947	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39868	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52399	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35892	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35891	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34374	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41928	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44263	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44267	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44237	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36820	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33155	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33160	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33163	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33173	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33183	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51200	vendor-advisoryx_refsource_REDHAT

Impacted products

47 products

Vendor	Product	Version
beaugunderson	ip-address	Affected: < 10.1.1
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:24.18.0-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:22.23.1-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:22.23.1-2.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260630152626.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260703140402.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626074955.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626075442.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Ansible Automation Platform 2.6	Unaffected: 1782721130 , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Developer Hub 1.10	Unaffected: 1783448184 , < * (rpm) cpe:/a:redhat:rhdh:1.10::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1782761244 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Migration Toolkit 1.8	Unaffected: 1783690532 , < * (rpm) cpe:/a:redhat:rhmt:1.8::el8
Red Hat	Red Hat OpenShift Container Platform 4.2	Unaffected: 1784724699 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1784713741 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 1784721581 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782498475 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782498792 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Service Mesh 2.6	Unaffected: 1781937133 , < * (rpm) cpe:/a:redhat:service_mesh:2.6::el8
Red Hat	Red Hat OpenShift Service Mesh 2.6	Unaffected: 1782287580 , < * (rpm) cpe:/a:redhat:service_mesh:2.6::el8
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782201894 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782201833 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782201696 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782201537 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782201851 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782201812 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782231869 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782201466 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat Satellite 6.19	Unaffected: 1786008041 , < * (rpm) cpe:/a:redhat:satellite:6.19::el9
Red Hat	Confidential Compute Attestation	cpe:/a:redhat:confidential_compute_attestation:1
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Exploit Intelligence	cpe:/a:redhat:exploit_intelligence:0
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	cpe:/a:redhat:camel_spring_boot:4
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4
Red Hat	Red Hat Build of Podman Desktop	cpe:/a:redhat:podman_desktop:1
Red Hat	Red Hat Build of Podman Desktop - Tech Preview	cpe:/a:redhat:podman_desktop:0
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Self-service automation portal 2	cpe:/a:redhat:ansible_portal:2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42338",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T14:46:11.633277Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T14:46:50.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:24.18.0-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260630152626.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260703140402.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626074955.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626075442.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform-tech-preview/mcp-server-rhel9",
            "product": "Red Hat Ansible Automation Platform 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782721130",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783448184",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782761244",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhmt:1.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhmtc/openshift-migration-ui-rhel8",
            "product": "Red Hat Migration Toolkit 1.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783690532",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784724699",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784713741",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784721581",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/code-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782498475",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/dashboard-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782498792",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2.6::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel8",
            "product": "Red Hat OpenShift Service Mesh 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1781937133",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2.6::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel8",
            "product": "Red Hat OpenShift Service Mesh 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782287580",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201894",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201833",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201696",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201537",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201851",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201812",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782231869",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/kiali-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782201466",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:satellite:6.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-remediations-rhel9",
            "product": "Red Hat Satellite 6.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786008041",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-sandboxed-containers/osc-pccs",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat-openshift-console-plugin-npm",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:exploit_intelligence:0"
            ],
            "defaultStatus": "affected",
            "packageName": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9",
            "product": "Exploit Intelligence",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/console-mce-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/console-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "ip-address",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_spring_boot:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ip-address",
            "product": "Red Hat build of Apache Camel for Spring Boot 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4"
            ],
            "defaultStatus": "affected",
            "packageName": "ip-address",
            "product": "Red Hat build of Apache Camel - HawtIO 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-podman-desktop.git",
            "product": "Red Hat Build of Podman Desktop",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdesktop/rh-podman-desktop-ext-sandbox-rhel10",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-gaudi-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/bootc-rocm-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhelai3/disk-image-cuda-rhel9",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rust",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rust",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-console-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/automation-portal",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-12T19:43:16.470Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by providing untrusted input to the Address6 constructor. When an application renders the output of Address6.group(), Address6.link(), or the AddressError.parseMessage as HTML without proper escaping, the attacker-controlled content can be executed in the user\u0027s browser."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T12:05:45.196Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42338"
          },
          {
            "name": "RHBZ#2476810",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476810"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39246"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35842"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35841"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41947"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39868"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52399"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35892"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35891"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34374"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33574"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41928"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44263"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44267"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44237"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33155"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33160"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33163"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33173"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33183"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51200"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:39246: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35842: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35841: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41947: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39868: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52399: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35892: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35891: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34374: Red Hat Ansible Automation Platform 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44263: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44267: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44237: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33155: Red Hat OpenShift Service Mesh 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33160: Red Hat OpenShift Service Mesh 3.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33163: Red Hat OpenShift Service Mesh 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33173: Red Hat OpenShift Service Mesh 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33183: Red Hat OpenShift Service Mesh 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51200: Red Hat Satellite 6.19"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-12T21:01:14.436Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-12T19:43:16.470Z",
            "value": "Made public."
          }
        ],
        "title": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ip-address",
          "vendor": "beaugunderson",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error\u0027s parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T19:43:16.470Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g"
        }
      ],
      "source": {
        "advisory": "GHSA-v2v4-37r5-5v8g",
        "discovery": "UNKNOWN"
      },
      "title": "ip-address: XSS in Address6 HTML-emitting methods"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42338",
    "datePublished": "2026-05-12T19:43:16.470Z",
    "dateReserved": "2026-04-26T13:26:14.514Z",
    "dateUpdated": "2026-08-10T12:05:45.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48615 (GCVE-0-2026-48615)

Vulnerability from cvelistv5 – Published: 2026-06-26 01:14 – Updated: 2026-06-26 13:35

Summary

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Severity

5.9 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-359 - Privacy Violation

Assigner

hackerone

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/june-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 22.22.3 , ≤ 22.22.3 (semver) Affected: 24.16.0 , ≤ 24.16.0 (semver) Affected: 26.3.0 , ≤ 26.3.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T13:34:45.532887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T13:35:00.592Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "22.22.3",
              "status": "affected",
              "version": "22.22.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.16.0",
              "status": "affected",
              "version": "24.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "26.3.0",
              "status": "affected",
              "version": "26.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.\r\n\r\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359 Privacy Violation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T01:14:36.524Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-48615",
    "datePublished": "2026-06-26T01:14:36.524Z",
    "dateReserved": "2026-05-22T15:00:09.276Z",
    "dateUpdated": "2026-06-26T13:35:00.592Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48618 (GCVE-0-2026-48618)

Vulnerability from cvelistv5 – Published: 2026-06-26 01:14 – Updated: 2026-08-10 12:05

Summary

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Severity

7.7 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-176 - Improper Handling of Unicode Encoding
CWE-289 - Authentication Bypass by Alternate Name

Assigner

hackerone

References

17 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/june-202…
https://access.redhat.com/security/cve/CVE-2026-48618	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2493337	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:39246	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35841	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41947	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39868	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52399	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35892	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35891	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9455	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28727	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29012	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7378	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30172	vendor-advisoryx_refsource_REDHAT

Impacted products

13 products

Vendor	Product	Version
nodejs	node	Affected: 22.22.3 , ≤ 22.22.3 (semver) Affected: 24.16.0 , ≤ 24.16.0 (semver) Affected: 26.3.0 , ≤ 26.3.0 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:24.18.0-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:22.23.1-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:22.23.1-2.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260630152626.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260703140402.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626074955.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626075442.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	Unaffected: 22.23.1-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 24.18.0-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 26.4.0-1.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 25.9.0-1.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 20.20.2-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48618",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T15:10:27.583362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T15:10:40.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:24.18.0-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260630152626.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260703140402.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626074955.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626075442.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "22.23.1-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "24.18.0-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.4.0-1.2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs25-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "25.9.0-1.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs20-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "20.20.2-1.hum1",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "datePublic": "2026-06-26T01:14:36.868Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-289",
                "description": "Authentication Bypass by Alternate Name",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T12:05:43.364Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-48618"
          },
          {
            "name": "RHBZ#2493337",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39246"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35842"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35841"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41947"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39868"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52399"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35892"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35891"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9455"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28727"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29012"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7378"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30172"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:39246: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35842: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35841: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41947: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39868: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52399: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35892: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35891: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9455: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28727: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29012: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7378: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30172: Red Hat Hardened Images"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-26T02:02:10.741Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-26T01:14:36.868Z",
            "value": "Made public."
          }
        ],
        "title": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "22.22.3",
              "status": "affected",
              "version": "22.22.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.16.0",
              "status": "affected",
              "version": "24.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "26.3.0",
              "status": "affected",
              "version": "26.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-176",
              "description": "CWE-176 Improper Handling of Unicode Encoding",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T01:14:36.868Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-48618",
    "datePublished": "2026-06-26T01:14:36.868Z",
    "dateReserved": "2026-05-22T15:00:09.276Z",
    "dateUpdated": "2026-08-10T12:05:43.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48933 (GCVE-0-2026-48933)

Vulnerability from cvelistv5 – Published: 2026-06-26 01:14 – Updated: 2026-08-10 12:05

Summary

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-190 - Integer Overflow
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

hackerone

References

17 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/june-202…
https://access.redhat.com/security/cve/CVE-2026-48933	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2493331	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:39246	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35841	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41947	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39868	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52399	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35892	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35891	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9455	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28727	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29012	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7378	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30172	vendor-advisoryx_refsource_REDHAT

Impacted products

13 products

Vendor	Product	Version
nodejs	node	Affected: 22.22.3 , ≤ 22.22.3 (semver) Affected: 24.16.0 , ≤ 24.16.0 (semver) Affected: 26.3.0 , ≤ 26.3.0 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:24.18.0-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:22.23.1-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:22.23.1-2.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260630152626.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260703140402.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626074955.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626075442.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	Unaffected: 22.23.1-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 24.18.0-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 26.4.0-1.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 25.9.0-1.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 20.20.2-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48933",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T15:05:58.547904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T15:06:12.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:24.18.0-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260630152626.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260703140402.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626074955.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626075442.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "22.23.1-1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "24.18.0-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.4.0-1.2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs25-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "25.9.0-1.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs20-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "20.20.2-1.hum1",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "datePublic": "2026-06-26T01:14:36.823Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T12:05:38.691Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-48933"
          },
          {
            "name": "RHBZ#2493331",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48933.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39246"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35842"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35841"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41947"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39868"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52399"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35892"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35891"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9455"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28727"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29012"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7378"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30172"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:39246: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35842: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35841: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41947: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39868: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52399: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35892: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35891: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9455: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28727: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29012: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7378: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30172: Red Hat Hardened Images"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-26T02:01:39.107Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-26T01:14:36.823Z",
            "value": "Made public."
          }
        ],
        "title": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "22.22.3",
              "status": "affected",
              "version": "22.22.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.16.0",
              "status": "affected",
              "version": "24.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "26.3.0",
              "status": "affected",
              "version": "26.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T01:14:36.823Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-48933",
    "datePublished": "2026-06-26T01:14:36.823Z",
    "dateReserved": "2026-05-26T15:00:06.427Z",
    "dateUpdated": "2026-08-10T12:05:38.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59873 (GCVE-0-2026-59873)

Vulnerability from cvelistv5 – Published: 2026-07-08 15:22 – Updated: 2026-07-08 19:41

Title

node-tar: Decompression/parse DoS via unlimited input

Summary

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/isaacs/node-tar/security/advis…	x_refsource_CONFIRM
https://github.com/isaacs/node-tar/commit/2812e93…	x_refsource_MISC
https://github.com/isaacs/node-tar/releases/tag/v7.5.19	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
isaacs	node-tar	Affected: < 7.5.19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59873",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T18:00:24.478882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T19:41:26.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-tar",
          "vendor": "isaacs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.5.19"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T15:22:40.077Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
        },
        {
          "name": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
        },
        {
          "name": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
        }
      ],
      "source": {
        "advisory": "GHSA-23hp-3jrh-7fpw",
        "discovery": "UNKNOWN"
      },
      "title": "node-tar: Decompression/parse DoS via unlimited input"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59873",
    "datePublished": "2026-07-08T15:22:40.077Z",
    "dateReserved": "2026-07-07T15:41:53.607Z",
    "dateUpdated": "2026-07-08T19:41:26.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59874 (GCVE-0-2026-59874)

Vulnerability from cvelistv5 – Published: 2026-07-08 15:23 – Updated: 2026-07-08 17:00

Title

node-tar: Negative tar entry size causes infinite loop in archive replace

Summary

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/isaacs/node-tar/security/advis…	x_refsource_CONFIRM
https://github.com/isaacs/node-tar/commit/9e78bf0…	x_refsource_MISC
https://github.com/isaacs/node-tar/releases/tag/v7.5.18	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
isaacs	node-tar	Affected: < 7.5.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59874",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T16:51:08.126808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T17:00:42.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-tar",
          "vendor": "isaacs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.5.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T15:23:47.527Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
        },
        {
          "name": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
        },
        {
          "name": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
        }
      ],
      "source": {
        "advisory": "GHSA-8x88-c5mf-7j5w",
        "discovery": "UNKNOWN"
      },
      "title": "node-tar: Negative tar entry size causes infinite loop in archive replace"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59874",
    "datePublished": "2026-07-08T15:23:47.527Z",
    "dateReserved": "2026-07-07T15:41:53.607Z",
    "dateUpdated": "2026-07-08T17:00:42.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

RHSA-2026:52399

CVE-2026-12151 (GCVE-0-2026-12151)

CVE-2026-13149 (GCVE-0-2026-13149)

CVE-2026-42338 (GCVE-0-2026-42338)

CVE-2026-48615 (GCVE-0-2026-48615)

CVE-2026-48618 (GCVE-0-2026-48618)

CVE-2026-48933 (GCVE-0-2026-48933)

CVE-2026-59873 (GCVE-0-2026-59873)

CVE-2026-59874 (GCVE-0-2026-59874)

Tags

Sightings

Nomenclature