RHSA-2026:52399
Vulnerability from csaf_opensuse - Published: 2026-08-10 00:00 - Updated: 2026-09-16 18:42Summary
security update for nodejs
Severity
Important
Notes
Title of the patch: security update for nodejs
Description of the patch: This security update provides a functional equivalent of RHSA-2026:52399.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:52399.
Patchnames: RHSA-2026:52399
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.9 (Medium)
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
10 products, the same list as for
CVE-2026-12151
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
10 products, the same list as for
CVE-2026-12151
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
10 products, the same list as for
CVE-2026-12151
Threats
Impact
important
7.4 (High)
Affected products
Recommended
10 products, the same list as for
CVE-2026-12151
Threats
Impact
important
7.5 (High)
Affected products
Recommended
10 products, the same list as for
CVE-2026-12151
Threats
Impact
important
7.5 (High)
Affected products
Recommended
10 products, the same list as for
CVE-2026-12151
Threats
Impact
important
7.5 (High)
Affected products
Recommended
10 products, the same list as for
CVE-2026-12151
Threats
Impact
important
References
26 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for nodejs",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2026:52399.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:52399.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2026:52399",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_52399.json"
},
{
"category": "self",
"summary": "URL for RHSA-2026:52399",
"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007412.html"
},
{
"category": "self",
"summary": "E-Mail link for RHSA-2026:52399",
"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007412.html"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12151 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12151/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-13149 page",
"url": "https://www.suse.com/security/cve/CVE-2026-13149/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42338 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42338/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48615 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48615/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48618 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48618/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48933 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48933/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59873 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59873/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59874 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59874/"
}
],
"title": "security update for nodejs",
"tracking": {
"current_release_date": "2026-09-16T18:42:59Z",
"generator": {
"date": "2026-08-10T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2026:52399",
"initial_release_date": "2026-08-10T00:00:00Z",
"revision_history": [
{
"date": "2026-08-10T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T18:01:19Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T18:42:59Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"product": {
"name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"product_id": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs-docs@22.23.1-2.module+el9.6.0+24604+449f851b?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"product": {
"name": "nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"product_id": "nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs-nodemon@3.1.14-1.module+el9.6.0+24604+449f851b?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"product": {
"name": "nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"product_id": "nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs-packaging@2021.06-4.module+el9.6.0+23473+45664c2d?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"product": {
"name": "nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"product_id": "nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs-packaging-bundler@2021.06-4.module+el9.6.0+23473+45664c2d?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product": {
"name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product_id": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:nodejs:node.js:1:22.23.1:*:*:*:-:*:*:*",
"purl": "pkg:rpm/suse/nodejs@22.23.1-2.module+el9.6.0+24604+449f851b?arch=x86_64\u0026epoch=1\u0026upstream=nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.src.rpm"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product": {
"name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product_id": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs-devel@22.23.1-2.module+el9.6.0+24604+449f851b?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product": {
"name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product_id": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs-full-i18n@22.23.1-2.module+el9.6.0+24604+449f851b?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product": {
"name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product_id": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/nodejs-libs@22.23.1-2.module+el9.6.0+24604+449f851b?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"product": {
"name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"product_id": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/npm@10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"product": {
"name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"product_id": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/v8-12.4-devel@12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b?arch=x86_64\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 9",
"product": {
"name": "SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:9"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64"
},
"product_reference": "nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64"
},
"product_reference": "nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch"
},
"product_reference": "nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64"
},
"product_reference": "nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64 as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64"
},
"product_reference": "nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch"
},
"product_reference": "nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch"
},
"product_reference": "nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch"
},
"product_reference": "nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
},
"product_reference": "npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64 as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
},
"product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-12151",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12151"
}
],
"notes": [
{
"category": "general",
"text": "Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches: Upgrade to undici \u003e= 6.26.0, \u003e= 7.28.0, or \u003e= 8.5.0. Workarounds:\nNo workaround is available. The fix must be applied through an upgrade.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12151",
"url": "https://www.suse.com/security/cve/CVE-2026-12151"
},
{
"category": "external",
"summary": "SUSE Bug 1268482 for CVE-2026-12151",
"url": "https://bugzilla.suse.com/1268482"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-10T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-12151"
},
{
"cve": "CVE-2026-13149",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-13149"
}
],
"notes": [
{
"category": "general",
"text": "brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding \u0027{}\u0027 brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-13149",
"url": "https://www.suse.com/security/cve/CVE-2026-13149"
},
{
"category": "external",
"summary": "SUSE Bug 1269911 for CVE-2026-13149",
"url": "https://bugzilla.suse.com/1269911"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-10T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-13149"
},
{
"cve": "CVE-2026-42338",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42338"
}
],
"notes": [
{
"category": "general",
"text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error\u0027s parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42338",
"url": "https://www.suse.com/security/cve/CVE-2026-42338"
},
{
"category": "external",
"summary": "SUSE Bug 1268097 for CVE-2026-42338",
"url": "https://bugzilla.suse.com/1268097"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-10T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-42338"
},
{
"cve": "CVE-2026-48615",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48615"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.\r\n\r\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48615",
"url": "https://www.suse.com/security/cve/CVE-2026-48615"
},
{
"category": "external",
"summary": "SUSE Bug 1268598 for CVE-2026-48615",
"url": "https://bugzilla.suse.com/1268598"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-10T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-48615"
},
{
"cve": "CVE-2026-48618",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48618"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48618",
"url": "https://www.suse.com/security/cve/CVE-2026-48618"
},
{
"category": "external",
"summary": "SUSE Bug 1268593 for CVE-2026-48618",
"url": "https://bugzilla.suse.com/1268593"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-10T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-48618"
},
{
"cve": "CVE-2026-48933",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48933"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48933",
"url": "https://www.suse.com/security/cve/CVE-2026-48933"
},
{
"category": "external",
"summary": "SUSE Bug 1268592 for CVE-2026-48933",
"url": "https://bugzilla.suse.com/1268592"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-10T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-48933"
},
{
"cve": "CVE-2026-59873",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59873"
}
],
"notes": [
{
"category": "general",
"text": "node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59873",
"url": "https://www.suse.com/security/cve/CVE-2026-59873"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-10T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-59873"
},
{
"cve": "CVE-2026-59874",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59874"
}
],
"notes": [
{
"category": "general",
"text": "node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59874",
"url": "https://www.suse.com/security/cve/CVE-2026-59874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-devel-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-docs-1:22.23.1-2.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-full-i18n-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-libs-1:22.23.1-2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:nodejs-nodemon-3.1.14-1.module+el9.6.0+24604+449f851b.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:nodejs-packaging-bundler-2021.06-4.module+el9.6.0+23473+45664c2d.noarch",
"SUSE Liberty Linux 9:npm-1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64",
"SUSE Liberty Linux 9:v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-10T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-59874"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…