RHSA-2026:96226
Vulnerability from csaf_redhat - Published: 2026-11-09 12:45 - Updated: 2026-11-09 12:46Summary
Red Hat Security Advisory: nodejs:24 security update
Severity
Important
Notes
Topic: An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)
* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
* minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)
* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)
* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)
* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).
7.5 (High)
Affected products
Fixed
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.
7.5 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.
6.5 (Medium)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.
7.4 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.
7.5 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in minimatch. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) through excessive CPU and memory consumption. By supplying a specially crafted glob expression, an attacker can trigger repetitive pattern segment expansion during compilation at higher optimization levels, leading to resource exhaustion.
5.9 (Medium)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Moderate
A flaw was found in SQLite. A heap-based buffer overflow exists in the Full-Text Search 5 (FTS5) extension during the merging of prefix document lists. An attacker capable of inserting negative row identifiers into a configured table and executing a prefix search query can cause data to be written beyond allocated memory. This issue can lead to memory corruption, resulting in application crashes, a Denial of Service (DoS), or potentially arbitrary code execution.
7.8 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in SQLite. When the Full Text Search (FTS5) extension is enabled and secure-delete mode is active, processing a database containing a corrupted search index triggers a heap-based buffer overflow. An attacker who tricks an application or user into opening a crafted database file can exploit this flaw to execute arbitrary code or cause a Denial of Service (DoS) by crashing the application.
7.8 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Important
A flaw was found in SQLite's session extension. A local attacker can supply a specially crafted changeset containing inconsistent table definitions, causing the application to write data past allocated memory boundaries. This heap-based buffer overflow results in memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS).
7.8 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-19534
Threats
Impact
Important
References
89 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)\n\n* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)\n\n* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)\n\n* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:96226",
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2528759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
},
{
"category": "external",
"summary": "2542700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
},
{
"category": "external",
"summary": "2542707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
},
{
"category": "external",
"summary": "2553656",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553656"
},
{
"category": "external",
"summary": "2553677",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553677"
},
{
"category": "external",
"summary": "2553678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553678"
},
{
"category": "external",
"summary": "2563607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563607"
},
{
"category": "external",
"summary": "2563953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563953"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96226.json"
}
],
"title": "Red Hat Security Advisory: nodejs:24 security update",
"tracking": {
"current_release_date": "2026-11-09T12:46:33+00:00",
"generator": {
"date": "2026-11-09T12:46:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:96226",
"initial_release_date": "2026-11-09T12:45:00+00:00",
"revision_history": [
{
"date": "2026-11-09T12:45:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-09T12:45:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-09T12:46:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src (nodejs:24)",
"product_id": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=src\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"product": {
"name": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src (nodejs:24)",
"product_id": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-6.module%2Bel9.8.0%2B25292%2B33251f3b?arch=src\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"product": {
"name": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src (nodejs:24)",
"product_id": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel9.8.0%2B24708%2Be71d2e1d?arch=src\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"product": {
"name": "nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch (nodejs:24)",
"product_id": "nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-docs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"product": {
"name": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch (nodejs:24)",
"product_id": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-6.module%2Bel9.8.0%2B25292%2B33251f3b?arch=noarch\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"product": {
"name": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch (nodejs:24)",
"product_id": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel9.8.0%2B24708%2Be71d2e1d?arch=noarch\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"product": {
"name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch (nodejs:24)",
"product_id": "nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-6.module%2Bel9.8.0%2B24708%2Be71d2e1d?arch=noarch\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"product": {
"name": "npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch (nodejs:24)",
"product_id": "npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/npm@11.19.1-1.24.22.1.5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24)",
"product_id": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product": {
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24)",
"product_id": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product": {
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24)",
"product_id": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product": {
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24)",
"product_id": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product": {
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24)",
"product_id": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product": {
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24)",
"product_id": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product": {
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24)",
"product_id": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24)",
"product_id": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.22.1.5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=aarch64\u0026epoch=3\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24)",
"product_id": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product": {
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24)",
"product_id": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product": {
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24)",
"product_id": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product": {
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24)",
"product_id": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product": {
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24)",
"product_id": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product": {
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24)",
"product_id": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product": {
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24)",
"product_id": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24)",
"product_id": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.22.1.5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=ppc64le\u0026epoch=3\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24)",
"product_id": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product": {
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24)",
"product_id": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product": {
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24)",
"product_id": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product": {
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24)",
"product_id": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product": {
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24)",
"product_id": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product": {
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24)",
"product_id": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product": {
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24)",
"product_id": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24)",
"product_id": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.22.1.5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=s390x\u0026epoch=3\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24)",
"product_id": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product": {
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24)",
"product_id": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product": {
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24)",
"product_id": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product": {
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24)",
"product_id": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product": {
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24)",
"product_id": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product": {
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24)",
"product_id": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product": {
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24)",
"product_id": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@24.22.1-5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
},
{
"category": "product_version",
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24)",
"product_id": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.22.1.5.module%2Bel9.8.0%2B25292%2B33251f3b?arch=x86_64\u0026epoch=3\u0026rpmmod=nodejs:24:9080020261105135730:rhel9"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24"
},
"product_reference": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24"
},
"product_reference": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24"
},
"product_reference": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
},
"product_reference": "nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24"
},
"product_reference": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24"
},
"product_reference": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24"
},
"product_reference": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
},
"product_reference": "nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24"
},
"product_reference": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24"
},
"product_reference": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24"
},
"product_reference": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
},
"product_reference": "nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24"
},
"product_reference": "nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24"
},
"product_reference": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24"
},
"product_reference": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24"
},
"product_reference": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
},
"product_reference": "nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24"
},
"product_reference": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24"
},
"product_reference": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24"
},
"product_reference": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
},
"product_reference": "nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24"
},
"product_reference": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24"
},
"product_reference": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24"
},
"product_reference": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
},
"product_reference": "nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24"
},
"product_reference": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24"
},
"product_reference": "nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24"
},
"product_reference": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24"
},
"product_reference": "nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24"
},
"product_reference": "nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24"
},
"product_reference": "npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24"
},
"product_reference": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24"
},
"product_reference": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24"
},
"product_reference": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
},
"product_reference": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-19534",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-09-04T17:21:01.599799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unrequested WebSocket subprotocol",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in undici\u0027s WebSocket client, which can lead to a Node.js process crash. The vulnerability is triggered when an application connects to a malicious or compromised server that responds with an unrequested WebSocket subprotocol, allowing a remote, unauthenticated attacker to cause a denial of service in affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19534"
},
{
"category": "external",
"summary": "RHBZ#2528759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19534"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
}
],
"release_date": "2026-09-04T17:10:05.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol"
},
{
"cve": "CVE-2026-87018",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-15T18:45:26.683580+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553677"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as an Important severity flaw for Red Hat products because an unauthenticated remote server can terminate a client Node.js process, halting all concurrent tasks and in-flight operations. In typical Red Hat deployments, containerized microservices and administrative consoles rely on undici or runtime fetch APIs to communicate with external web endpoints. Exploitation requires the client application to establish an outbound TLS 1.2 connection to a malicious or compromised endpoint that initiates session renegotiation with a non-matching certificate. Workloads communicating strictly with trusted endpoints or utilizing TLS 1.3 connections are inherently protected, as TLS 1.3 does not permit server-driven renegotiation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87018"
},
{
"category": "external",
"summary": "RHBZ#2553677",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553677"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87018"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"
}
],
"release_date": "2026-10-15T18:38:25.613000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate"
},
{
"cve": "CVE-2026-102276",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-28T21:02:20.910434+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542707"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can crash running Node.js services by submitting malformed pattern strings, resulting in a denial of service. In Red Hat environments, applications that accept arbitrary glob or expansion patterns from external inputs are susceptible to unexpected termination due to an unhandled call stack overflow. While this flaw allows service interruption without requiring privileges, it does not lead to code execution or compromise data confidentiality and integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102276"
},
{
"category": "external",
"summary": "RHBZ#2542707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102276"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
}
],
"release_date": "2026-09-28T20:50:59.984000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns"
},
{
"cve": "CVE-2026-102278",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-28T21:00:55.949756+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542700"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because remote unauthenticated attackers can supply crafted nested expressions to trigger native stack exhaustion and crash server-side processes, resulting in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, the affected library is distributed across containerized web consoles, developer tools, and Node.js runtime environments. Exploitation is constrained to deployments where applications process untrusted, user-defined pattern inputs directly through expansion functions without input depth validation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102278"
},
{
"category": "external",
"summary": "RHBZ#2542700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102278"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
}
],
"release_date": "2026-09-28T20:57:09.850000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns"
},
{
"cve": "CVE-2026-109383",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-15T18:45:43.553803+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Certificate validation bypass via dropped TLS options in Agent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity for Red Hat products because an attacker positioned on the network could bypass custom cryptographic protections, allowing the interception or tampering of sensitive traffic. Standard system trust stores and default certificate chain validations are not compromised by this flaw, which reduces exposure for environments relying solely on standard public key infrastructure. The elevated risk is restricted to services and applications that configure specialized certificate validation handlers, such as explicit certificate or public key pinning, when establishing outbound connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109383"
},
{
"category": "external",
"summary": "RHBZ#2553678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109383"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/f75eac00ac17",
"url": "https://github.com/nodejs/undici/commit/f75eac00ac17"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"
}
],
"release_date": "2026-10-15T18:34:01.468000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent"
},
{
"cve": "CVE-2026-109869",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-15T18:31:39.700754+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553656"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an unauthenticated remote server can trigger an unhandled runtime error that abruptly terminates the parent Node.js process, bypassing application-level catch blocks. In Red Hat products and containerized workloads running affected Node.js runtimes, the flaw impacts services executing outbound HTTP calls to untrusted or external third-party endpoints. Conversely, deployments where applications only interact with verified internal endpoints or do not fetch content from untrusted remote hosts are not exposed to this denial-of-service condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109869"
},
{
"category": "external",
"summary": "RHBZ#2553656",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553656"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/commit/b5084c7dc239",
"url": "https://github.com/nodejs/undici/commit/b5084c7dc239"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"
}
],
"release_date": "2026-10-15T18:08:31.243000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings"
},
{
"cve": "CVE-2026-118764",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-10-29T18:14:47.608042+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2563607"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) through excessive CPU and memory consumption. By supplying a specially crafted glob expression, an attacker can trigger repetitive pattern segment expansion during compilation at higher optimization levels, leading to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as having a Moderate impact because exploitation requires non-default preconditions and untrusted input exposure, while the blast radius is confined to an application denial of service. Within typical Red Hat environments, the library operates under default configurations where the flawed pattern compilation path remains inactive. Service disruption can only occur if a downstream application explicitly enables elevated optimization levels while processing unvalidated user-supplied glob expressions, causing thread blocking and memory exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-118764"
},
{
"category": "external",
"summary": "RHBZ#2563607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-118764",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118764"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-118764",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118764"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8",
"url": "https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/releases/tag/v11.0.1",
"url": "https://github.com/isaacs/minimatch/releases/tag/v11.0.1"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"
}
],
"release_date": "2026-10-29T17:07:11.357000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
},
{
"category": "workaround",
"details": "Avoid passing untrusted, user-controlled input as glob patterns to minimatch. If dynamic input is necessary, enforce strict limits on pattern length and path segments, set optimization levels below level 2, and apply execution timeouts or container CPU/memory constraints to prevent denial-of-service via resource exhaustion.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion"
},
{
"cve": "CVE-2026-119373",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-30T12:08:53.613331+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2563953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite. A heap-based buffer overflow exists in the Full-Text Search 5 (FTS5) extension during the merging of prefix document lists. An attacker capable of inserting negative row identifiers into a configured table and executing a prefix search query can cause data to be written beyond allocated memory. This issue can lead to memory corruption, resulting in application crashes, a Denial of Service (DoS), or potentially arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as having a security impact of Important because it can trigger heap memory corruption, potentially allowing arbitrary code execution within the context of the application utilizing the library. Exploitation requires specific preconditions, specifically an application using SQLite\u0027s Full-Text Search 5 module configured with suppressed detail storage that accepts negative row values and runs targeted search expressions. Applications that do not expose virtual full-text indexing or that restrict untrusted database inputs are not susceptible to this attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-119373"
},
{
"category": "external",
"summary": "RHBZ#2563953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-119373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119373"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-119373",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119373"
},
{
"category": "external",
"summary": "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge",
"url": "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite",
"url": "https://github.com/sqlite/sqlite"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107",
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80",
"url": "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80"
},
{
"category": "external",
"summary": "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z",
"url": "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_54_0.html",
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/a7f8c92f62",
"url": "https://sqlite.org/src/info/a7f8c92f62"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists",
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"
}
],
"release_date": "2026-10-30T11:30:39.153000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5"
},
{
"cve": "CVE-2026-119374",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-30T12:56:42.628633+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2563978"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite. When the Full Text Search (FTS5) extension is enabled and secure-delete mode is active, processing a database containing a corrupted search index triggers a heap-based buffer overflow. An attacker who tricks an application or user into opening a crafted database file can exploit this flaw to execute arbitrary code or cause a Denial of Service (DoS) by crashing the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important rather than Moderate because an attacker who successfully tricks a system application or user into interacting with a crafted database can trigger arbitrary code execution in the context of that application. Across Red Hat Enterprise Linux, SQLite is widely deployed as an embedded database library, exposing numerous system utilities and user applications to untrusted database inputs. However, triggering this flaw requires the specific combination of the FTS5 extension and secure deletion mode being active while deleting records, which limits exposure in standard deployments where secure deletion is not enabled or databases are strictly internal.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-119374"
},
{
"category": "external",
"summary": "RHBZ#2563978",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563978"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-119374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-119374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119374"
},
{
"category": "external",
"summary": "https://abraxaslabs.tech/research/sqlite-fts5-securedel",
"url": "https://abraxaslabs.tech/research/sqlite-fts5-securedel"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite",
"url": "https://github.com/sqlite/sqlite"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525",
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9",
"url": "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_54_0.html",
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/9cd4f9e920",
"url": "https://sqlite.org/src/info/9cd4f9e920"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete",
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"
}
],
"release_date": "2026-10-30T11:30:39.834000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index"
},
{
"cve": "CVE-2026-119379",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-30T12:13:33.513499+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2563955"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite\u0027s session extension. A local attacker can supply a specially crafted changeset containing inconsistent table definitions, causing the application to write data past allocated memory boundaries. This heap-based buffer overflow results in memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: sqlite: Arbitrary code execution via crafted session changesets",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important rather than Critical because successful exploitation requires an application utilizing the SQLite session module to ingest and process an untrusted, maliciously constructed changeset. While SQLite is pervasive across Red Hat Enterprise Linux, standard deployments rarely expose session synchronization interfaces directly to untrusted users. In environments where client applications or services accept external session changes, an attacker could trigger heap corruption, leading to application crashes or arbitrary code execution within the privileges of the affected process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-119379"
},
{
"category": "external",
"summary": "RHBZ#2563955",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563955"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-119379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-119379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119379"
},
{
"category": "external",
"summary": "https://abraxaslabs.tech/research/sqlite-session-ncol",
"url": "https://abraxaslabs.tech/research/sqlite-session-ncol"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite",
"url": "https://github.com/sqlite/sqlite"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619",
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619"
},
{
"category": "external",
"summary": "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52",
"url": "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52"
},
{
"category": "external",
"summary": "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z",
"url": "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_54_0.html",
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/3f57024aecea0f3b",
"url": "https://sqlite.org/src/info/3f57024aecea0f3b"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind",
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"
}
],
"release_date": "2026-10-30T11:30:43.335000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-09T12:45:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:96226"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-6.module+el9.8.0+25292+33251f3b.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.src::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el9.8.0+24708+e71d2e1d.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b.noarch::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.aarch64::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.ppc64le::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.s390x::nodejs:24",
"AppStream-9.8.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: sqlite: Arbitrary code execution via crafted session changesets"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.