RHSA-2026:99436

Vulnerability from csaf_redhat - Published: 2026-11-11 23:59 - Updated: 2026-11-13 13:33
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: nodejs26: * nodejs26-1:26.13.1-0.1.hum1 (aarch64, s390x, x86_64) * nodejs26-bin-1:26.13.1-0.1.hum1 (noarch) * nodejs26-devel-1:26.13.1-0.1.hum1 (aarch64, s390x, x86_64) * nodejs26-docs-1:26.13.1-0.1.hum1 (noarch) * nodejs26-full-i18n-1:26.13.1-0.1.hum1 (aarch64, s390x, x86_64) * nodejs26-libs-1:26.13.1-0.1.hum1 (aarch64, s390x, x86_64) * nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1 (noarch) * nodejs26-npm-bin-1:26.13.1-0.1.hum1 (noarch) * v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1 (aarch64, s390x, x86_64) * nodejs26-1:26.13.1-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-116592

A flaw was found in undici. When handling HTTP redirects with a shared cache enabled, the client inspects only the final redirect destination and fails to account for intermediate hops. A remote attacker who controls a redirect target can exploit this vulnerability to poison the shared cache, which can lead to unauthorized information disclosure if private responses are stored and served to other users.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64 —
Workaround
Unresolved product id: Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x —
Workaround
Unresolved product id: Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64 —
Workaround
Threats
Impact Important
CVE-2026-123828

A flaw was found in Node.js. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a specially crafted request with an oversized header to an application that processes HTTP/2 Alternative Services (Alt-Svc). Due to an off-by-one heap buffer overflow, the application writes one byte past the allocated memory buffer, corrupting process memory and causing the server to crash.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Moderate
CVE-2026-123829

A flaw was found in Node.js. When recursive file watching is used on macOS and Windows systems, the Node.js Permission Model checks read permissions only on the root directory being monitored rather than validating each nested path. A local process running with restricted permissions can exploit this behavior to observe file system events in unauthorized subdirectories. This flaw leads to information disclosure by exposing restricted file and directory names as well as event timing metadata, although it does not expose actual file contents.

2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Low
CVE-2026-123862

A flaw was found in Node.js. A remote peer can trigger a denial of service (DoS) by abruptly disconnecting while data is being compressed using the zlib streaming interface. Under specific conditions where stream settings are adjusted during active compression, a sudden disconnection causes an internal assertion failure. Because this error bypasses standard application error handlers, it terminates the Node.js process unexpectedly.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248 - Uncaught Exception
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Moderate
CVE-2026-123863

A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) by triggering an abnormal server crash during HTTP/2 session termination. By sending a request where the server responds before the request body has finished transmitting, an individual stream can outlive its parent session while retaining allocated memory. This inconsistency triggers an internal check failure during session cleanup, immediately terminating the server process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Important
CVE-2026-123864

A flaw was found in Node.js. An unauthenticated remote attacker can exploit a re-entrancy vulnerability in the HTTPS server to cause memory corruption and read memory belonging to other connections. Under specific request handling conditions, processing incoming encrypted data while the HTTP parser is active causes freed or out-of-bounds heap memory to be read and returned to the client. This flaw leads to information disclosure, potentially exposing sensitive data such as other users' requests and Transport Layer Security (TLS) private keys.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Important
CVE-2026-123865

A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) through resource exhaustion by permanently leaking server memory and file descriptors. By initiating a connection shutdown and sending a protocol-violating HTTP/2 frame, the internal protocol handler terminates the session without Node.js properly releasing the associated state. Over time, an attacker can accumulate dangling connections, ultimately exhausting server resources and disrupting service availability.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 - Uncontrolled Resource Consumption
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Important
CVE-2026-123866

A flaw was found in Node.js. A use-after-free vulnerability in the HTTP/2 stream handling mechanism allows for information disclosure. When a stream is terminated while outgoing data is delayed, the server frees the response buffer prematurely while continuing to reference it. A remote attacker can exploit this condition to cause the server to transmit unrelated memory from the heap, potentially exposing sensitive data belonging to other user connections.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-416 - Use After Free
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Important
CVE-2026-123867

A flaw was found in Node.js. When a Transport Layer Security (TLS) server configures a host-specific client Certificate Authority (CA) without providing an associated server certificate, the per-host client validation settings fail to apply. Consequently, the connection silently falls back to trusting the default client CA. A remote client authorized only for the default host can exploit this flaw to bypass mutual TLS (mTLS) restrictions and gain unauthorized access to protected hostnames.

4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Moderate
CVE-2026-123868

A flaw was found in Node.js. An unauthenticated remote attacker can cause a denial of service (DoS) by exhausting server memory. By transmitting streams containing numerous small HTTP/2 data frames, incoming data is queued without being properly accounted against session memory limits. This allows an attacker to consume disproportionate amounts of system memory with relatively little network traffic, ultimately causing the server process to crash.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 - Uncontrolled Resource Consumption
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Moderate
CVE-2026-123871

A flaw was found in Node.js. This vulnerability allows information disclosure when invalid proxy configurations trigger error handling routines that fail to redact authentication details. Under these conditions, the application outputs raw proxy URLs containing embedded usernames and passwords to error streams and log services. An unauthorized actor with access to system logs, monitoring outputs, or crash reports can retrieve these credentials to access restricted proxy resources.

6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-209 - Generation of Error Message Containing Sensitive Information
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Moderate
CVE-2026-123872

A flaw was found in Node.js. An authenticated remote attacker can bypass client certificate authentication policies on servers configuring different security requirements per hostname. By renegotiating an established Transport Layer Security (TLS) connection and changing the target server name, the attacker can carry forward their existing authenticated session to gain unauthorized access to restricted endpoints.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-287 - Improper Authentication
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Important
CVE-2026-123874

A flaw was found in Node.js. A use-after-free memory flaw in the HTTP/2 implementation allows an unauthenticated remote attacker to corrupt server memory and cause a Denial of Service (DoS). By sending requests while the server is serving files, an attacker can cause the server to release an active stream object while a write operation is still queued. When the pending write completes, referencing the freed object leads to server memory corruption and terminates the process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Important
CVE-2026-123875

A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) by terminating the server process during file transfers. When a client cancels an active file download over an HTTP/2 connection, internal streaming resources are released out of sequence, resulting in an invalid memory access that crashes the application.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Moderate
CVE-2026-123877

A flaw was found in Node.js. When managing outbound HTTPS connections, the client connection agent generates identical session-cache keys for requests with differing Certificate Authority (CA) trust configurations. Consequently, an existing Transport Layer Security (TLS) session established under a broad trust policy can be improperly reused by a subsequent request requiring stricter validation. An attacker could exploit this certificate validation bypass to receive confidential data that the application inadvertently transmits to an unauthorized server.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Moderate
CVE-2026-126051

A flaw was found in Node.js. A remote, unauthenticated attacker can exploit this vulnerability to cause a denial of service (DoS) by terminating the server process. When a Transport Layer Security (TLS) server is configured with certain handshake callback hooks, it fails to handle situations where the underlying network connection is closed before the deferred callback executes. By sending a specially crafted TLS handshake request immediately followed by a connection closure, an attacker triggers an unhandled exception that crashes the application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 25 products, the same list as for CVE-2026-116592
Known not affected 3 products, the same list as for CVE-2026-116592
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:99436 self
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-123872 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/cve/CVE-2026-126051 external
https://access.redhat.com/security/cve/CVE-2026-123877 external
https://access.redhat.com/security/cve/CVE-2026-123874 external
https://access.redhat.com/security/cve/CVE-2026-123868 external
https://access.redhat.com/security/cve/CVE-2026-123864 external
https://access.redhat.com/security/cve/CVE-2026-123875 external
https://access.redhat.com/security/cve/CVE-2026-123866 external
https://access.redhat.com/security/cve/CVE-2026-123863 external
https://access.redhat.com/security/cve/CVE-2026-123871 external
https://access.redhat.com/security/cve/CVE-2026-123867 external
https://access.redhat.com/security/cve/CVE-2026-123865 external
https://access.redhat.com/security/cve/CVE-2026-123829 external
https://access.redhat.com/security/cve/CVE-2026-123862 external
https://access.redhat.com/security/cve/CVE-2026-123828 external
https://access.redhat.com/security/cve/CVE-2026-116630 external
https://access.redhat.com/security/cve/CVE-2026-120222 external
https://access.redhat.com/security/cve/CVE-2026-120423 external
https://access.redhat.com/security/cve/CVE-2026-120474 external
https://access.redhat.com/security/cve/CVE-2026-120415 external
https://access.redhat.com/security/cve/CVE-2026-116592 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-116592 self
https://bugzilla.redhat.com/show_bug.cgi?id=2568222 external
https://www.cve.org/CVERecord?id=CVE-2026-116592 external
https://nvd.nist.gov/vuln/detail/CVE-2026-116592 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-123828 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571813 external
https://www.cve.org/CVERecord?id=CVE-2026-123828 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123828 external
https://nodejs.org/en/blog/vulnerability/november… external
https://access.redhat.com/security/cve/CVE-2026-123829 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571829 external
https://www.cve.org/CVERecord?id=CVE-2026-123829 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123829 external
https://access.redhat.com/security/cve/CVE-2026-123862 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571814 external
https://www.cve.org/CVERecord?id=CVE-2026-123862 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123862 external
https://access.redhat.com/security/cve/CVE-2026-123863 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571842 external
https://www.cve.org/CVERecord?id=CVE-2026-123863 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123863 external
https://access.redhat.com/security/cve/CVE-2026-123864 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571836 external
https://www.cve.org/CVERecord?id=CVE-2026-123864 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123864 external
https://access.redhat.com/security/cve/CVE-2026-123865 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571831 external
https://www.cve.org/CVERecord?id=CVE-2026-123865 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123865 external
https://access.redhat.com/security/cve/CVE-2026-123866 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571844 external
https://www.cve.org/CVERecord?id=CVE-2026-123866 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123866 external
https://access.redhat.com/security/cve/CVE-2026-123867 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571835 external
https://www.cve.org/CVERecord?id=CVE-2026-123867 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123867 external
https://access.redhat.com/security/cve/CVE-2026-123868 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571834 external
https://www.cve.org/CVERecord?id=CVE-2026-123868 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123868 external
https://access.redhat.com/security/cve/CVE-2026-123871 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571841 external
https://www.cve.org/CVERecord?id=CVE-2026-123871 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123871 external
https://access.redhat.com/security/cve/CVE-2026-123872 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571847 external
https://www.cve.org/CVERecord?id=CVE-2026-123872 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123872 external
https://access.redhat.com/security/cve/CVE-2026-123874 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571849 external
https://www.cve.org/CVERecord?id=CVE-2026-123874 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123874 external
https://access.redhat.com/security/cve/CVE-2026-123875 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571848 external
https://www.cve.org/CVERecord?id=CVE-2026-123875 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123875 external
https://access.redhat.com/security/cve/CVE-2026-123877 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571854 external
https://www.cve.org/CVERecord?id=CVE-2026-123877 external
https://nvd.nist.gov/vuln/detail/CVE-2026-123877 external
https://access.redhat.com/security/cve/CVE-2026-126051 self
https://bugzilla.redhat.com/show_bug.cgi?id=2571861 external
https://www.cve.org/CVERecord?id=CVE-2026-126051 external
https://nvd.nist.gov/vuln/detail/CVE-2026-126051 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnodejs26:\n  * nodejs26-1:26.13.1-0.1.hum1 (aarch64, s390x, x86_64)\n  * nodejs26-bin-1:26.13.1-0.1.hum1 (noarch)\n  * nodejs26-devel-1:26.13.1-0.1.hum1 (aarch64, s390x, x86_64)\n  * nodejs26-docs-1:26.13.1-0.1.hum1 (noarch)\n  * nodejs26-full-i18n-1:26.13.1-0.1.hum1 (aarch64, s390x, x86_64)\n  * nodejs26-libs-1:26.13.1-0.1.hum1 (aarch64, s390x, x86_64)\n  * nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1 (noarch)\n  * nodejs26-npm-bin-1:26.13.1-0.1.hum1 (noarch)\n  * v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1 (aarch64, s390x, x86_64)\n  * nodejs26-1:26.13.1-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:99436",
        "url": "https://access.redhat.com/errata/RHSA-2026:99436"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123872",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123872"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-126051",
        "url": "https://access.redhat.com/security/cve/CVE-2026-126051"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123877",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123877"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123874",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123874"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123868",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123868"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123864",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123864"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123875",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123875"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123866",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123866"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123863",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123863"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123871",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123871"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123867",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123867"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123865",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123865"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123829",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123829"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-123828",
        "url": "https://access.redhat.com/security/cve/CVE-2026-123828"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-116630",
        "url": "https://access.redhat.com/security/cve/CVE-2026-116630"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-120222",
        "url": "https://access.redhat.com/security/cve/CVE-2026-120222"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-120423",
        "url": "https://access.redhat.com/security/cve/CVE-2026-120423"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-120474",
        "url": "https://access.redhat.com/security/cve/CVE-2026-120474"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-120415",
        "url": "https://access.redhat.com/security/cve/CVE-2026-120415"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-116592",
        "url": "https://access.redhat.com/security/cve/CVE-2026-116592"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99436.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-13T13:33:41+00:00",
      "generator": {
        "date": "2026-11-13T13:33:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:99436",
      "initial_release_date": "2026-11-11T23:59:19+00:00",
      "revision_history": [
        {
          "date": "2026-11-11T23:59:19+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-12T01:51:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-13T13:33:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.13.1-0.1.hum1@aarch64",
                "product": {
                  "name": "nodejs26-1:26.13.1-0.1.hum1@aarch64",
                  "product_id": "nodejs26-1:26.13.1-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.13.1-0.1.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
                "product": {
                  "name": "nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
                  "product_id": "nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.13.1-0.1.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
                  "product_id": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.13.1-0.1.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
                "product": {
                  "name": "nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
                  "product_id": "nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.13.1-0.1.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.13.1.0.1.hum1?arch=aarch64\u0026epoch=3\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.13.1-0.1.hum1@s390x",
                "product": {
                  "name": "nodejs26-1:26.13.1-0.1.hum1@s390x",
                  "product_id": "nodejs26-1:26.13.1-0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.13.1-0.1.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
                "product": {
                  "name": "nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
                  "product_id": "nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.13.1-0.1.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
                  "product_id": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.13.1-0.1.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
                "product": {
                  "name": "nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
                  "product_id": "nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.13.1-0.1.hum1?arch=s390x\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.13.1.0.1.hum1?arch=s390x\u0026epoch=3\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.13.1-0.1.hum1@src",
                "product": {
                  "name": "nodejs26-1:26.13.1-0.1.hum1@src",
                  "product_id": "nodejs26-1:26.13.1-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.13.1-0.1.hum1?arch=src\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.13.1-0.1.hum1@x86_64",
                "product": {
                  "name": "nodejs26-1:26.13.1-0.1.hum1@x86_64",
                  "product_id": "nodejs26-1:26.13.1-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.13.1-0.1.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
                "product": {
                  "name": "nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
                  "product_id": "nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.13.1-0.1.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
                  "product_id": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.13.1-0.1.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
                "product": {
                  "name": "nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
                  "product_id": "nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.13.1-0.1.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.13.1.0.1.hum1?arch=x86_64\u0026epoch=3\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-bin@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-bin@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-bin@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-docs@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-docs@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-docs@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm@11.20.0-1.26.13.1.0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm@11.20.0-1.26.13.1.0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm@11.20.0-1.26.13.1.0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm-bin@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm-bin@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm-bin@26.13.1-0.1.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.13.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64"
        },
        "product_reference": "nodejs26-1:26.13.1-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.13.1-0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x"
        },
        "product_reference": "nodejs26-1:26.13.1-0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.13.1-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src"
        },
        "product_reference": "nodejs26-1:26.13.1-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.13.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64"
        },
        "product_reference": "nodejs26-1:26.13.1-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.13.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64"
        },
        "product_reference": "nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.13.1-0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x"
        },
        "product_reference": "nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.13.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64"
        },
        "product_reference": "nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64"
        },
        "product_reference": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x"
        },
        "product_reference": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64"
        },
        "product_reference": "nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.13.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64"
        },
        "product_reference": "nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.13.1-0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x"
        },
        "product_reference": "nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.13.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64"
        },
        "product_reference": "nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-116592",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-11-06T14:35:36.164614+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2568222"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When handling HTTP redirects with a shared cache enabled, the client inspects only the final redirect destination and fails to account for intermediate hops. A remote attacker who controls a redirect target can exploit this vulnerability to poison the shared cache, which can lead to unauthorized information disclosure if private responses are stored and served to other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Cache poisoning via intermediate redirect hops",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because successful exploitation can result in significant integrity and confidentiality compromises, allowing attackers to poison shared HTTP caches or expose private, user-specific responses. Risk is constrained to applications explicitly configured with an originless Agent combining shared response caching with automated redirect following. Workloads employing origin-bound dispatchers, isolated caching mechanisms, or redirection handling before caching are not susceptible to this flaw.\n\nThis flaw is a bypass of the incomplete fix for CVE-2026-109829 and is present only in undici 7.30.1 and 8.12.2-8.12.3; earlier 7.x/8.x versions fall within the scope of CVE-2026-109829, and fixed versions are 7.30.2 and 8.12.4. Node.js\u0027s built-in fetch API (which vendors undici internally) does not expose the vulnerable Agent/interceptor-composition configuration; exposure requires an application explicitly using the undici npm package with an originless Agent, a shared cache store, and compose(redirect(), cache()).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-116592"
        },
        {
          "category": "external",
          "summary": "RHBZ#2568222",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568222"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-116592",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-116592"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116592",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116592"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-mqg3-3v4r-cm32",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-mqg3-3v4r-cm32"
        }
      ],
      "release_date": "2026-11-06T10:05:41.972000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Configure Node.js applications utilizing undici to avoid vulnerable interceptor ordering:\n\n1. Reorder interceptors: Structure the interceptor pipeline so caching is evaluated prior to redirection, such as using compose(cache(), redirect()).\n2. Isolate cache boundaries: Replace shared originless Agent configurations with origin-bound Client or Pool dispatchers and separate cache stores.\n3. Restrict shared caching: Disable shared caching on client requests that permit automated redirect following.\n\nCaveats: Disabling shared caching or modifying dispatcher architecture may increase request latency and backend server load.\nWarning: Applying these application configuration changes requires restarting the affected Node.js service.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to reconfigure undici interceptors to evaluate caching prior to redirection or isolate dispatchers and cache stores per origin: upgrade to undici 7.30.2, 8.12.4+ (or the corresponding fixed Red Hat builds), which account for intermediate redirect hops and enforce cache validation and header retention across all hops before storing responses under the original request key, closing all 3 injection vectors (intermediate redirect bounce through untrusted origin, dropping intermediate Vary header to expose private cached responses, laundering non-storable intermediate redirects via missing no-cache validation). Until patched, this is a concern on Node.js applications using an originless undici Agent composing redirect and shared cache interceptors, so reorder interceptors to evaluate cache before redirect, use origin-bound dispatchers with isolated cache stores, or disable shared caching on requests that permit redirect following. As a compensating measure, block outbound network connections to unapproved external endpoints to prevent reaching attacker-controlled intermediate redirect targets and restrict server-initiated requests and redirect hops to an explicit allowlist of permitted destinations. These controls limit blast radius and contain exploitation, but they do not fix the underlying intermediate redirect cache poisoning defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-208 Outbound Network Egress Restriction (SSRF Blast Radius Containment) (medium)",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Cache poisoning via intermediate redirect hops"
    },
    {
      "cve": "CVE-2026-123828",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2026-11-11T18:20:53.946490+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a specially crafted request with an oversized header to an application that processes HTTP/2 Alternative Services (Alt-Svc). Due to an off-by-one heap buffer overflow, the application writes one byte past the allocated memory buffer, corrupting process memory and causing the server to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: Denial of Service via HTTP/2 Alt-Svc heap buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as Moderate severity because exploitation requires specific application-level code to process untrusted input through the HTTP/2 Alternative Services API, limiting broad exposure despite potential process crashes. Standard deployments do not automatically pass client-controlled headers to this interface. The flaw primarily presents an availability risk through application termination rather than arbitrary code execution under standard runtime protections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123828"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123828",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123828"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123828",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123828"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:10:54.030000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Do not pass attacker-controlled values such as the request :authority into Http2Session.altsvc(). If Alt-Svc is unused, terminate HTTP/2 at a reverse proxy and avoid calling altsvc() with untrusted input.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: nodejs: Denial of Service via HTTP/2 Alt-Svc heap buffer overflow"
    },
    {
      "cve": "CVE-2026-123829",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2026-11-11T18:21:52.586023+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571829"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. When recursive file watching is used on macOS and Windows systems, the Node.js Permission Model checks read permissions only on the root directory being monitored rather than validating each nested path. A local process running with restricted permissions can exploit this behavior to observe file system events in unauthorized subdirectories. This flaw leads to information disclosure by exposing restricted file and directory names as well as event timing metadata, although it does not expose actual file contents.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Information disclosure via improper permission checks in recursive file watching",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Low severity because the flaw is confined to local environments, demands specific non-default execution flags, and only leaks filesystem metadata such as names and timestamps rather than actual file data. In typical Red Hat deployments on Linux systems, the native backend monitoring mechanisms implicated in this issue are not utilized, eliminating exposure. Consequently, standard production workloads running Node.js on supported Red Hat platforms remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123829"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571829",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571829"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123829",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123829"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123829",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123829"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:12:41.452000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "On Linux this issue does not apply. On macOS/Windows under --permission, avoid recursive fs.watch() on directories with narrower descendant read grants, or intentionally broaden the read grant to cover watched descendants.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Information disclosure via improper permission checks in recursive file watching"
    },
    {
      "cve": "CVE-2026-123862",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-11-11T18:20:57.338955+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571814"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote peer can trigger a denial of service (DoS) by abruptly disconnecting while data is being compressed using the zlib streaming interface. Under specific conditions where stream settings are adjusted during active compression, a sudden disconnection causes an internal assertion failure. Because this error bypasses standard application error handlers, it terminates the Node.js process unexpectedly.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of service via abrupt disconnection during zlib compression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate because although a remote unauthenticated attacker can crash the runtime environment, successful exploitation requires precise timing alongside an uncommon programming pattern. In typical Red Hat enterprise environments, applications rarely dynamically adjust compression parameters during active data transmission to remote clients. Consequently, the blast radius is restricted to custom implementations that explicitly reconfigure stream parameters on in-flight traffic.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571814",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571814"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123862"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:14:26.996000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Avoid calling zlib.params() while streaming compressed output to a remote peer. Prefer fixed compression settings for long-lived streams, and handle peer disconnects without destroying a zlib stream that still has a pending params() flush.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of service via abrupt disconnection during zlib compression"
    },
    {
      "cve": "CVE-2026-123863",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-11-11T18:31:35.878275+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571842"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) by triggering an abnormal server crash during HTTP/2 session termination. By sending a request where the server responds before the request body has finished transmitting, an individual stream can outlive its parent session while retaining allocated memory. This inconsistency triggers an internal check failure during session cleanup, immediately terminating the server process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service via improper HTTP/2 session teardown",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger an unexpected server crash, causing a full denial of service without requiring authentication or user interaction. In Red Hat environments, the impact directly affects deployments hosting Node.js applications that utilize the built-in HTTP/2 server module exposed to untrusted network traffic. Applications serving requests exclusively over HTTP/1.1 or situated behind reverse proxies that terminate HTTP/2 traffic are not exposed to this failure path.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123863"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571842",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571842"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123863",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123863"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123863",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123863"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:16:12.733000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Terminate HTTP/2 at a trusted reverse proxy and proxy HTTP/1.1 to Node.js (see CME-202). Restrict direct Node.js HTTP/2 listeners to trusted networks only.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service via improper HTTP/2 session teardown"
    },
    {
      "cve": "CVE-2026-123864",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-11-11T18:31:15.337935+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571836"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An unauthenticated remote attacker can exploit a re-entrancy vulnerability in the HTTPS server to cause memory corruption and read memory belonging to other connections. Under specific request handling conditions, processing incoming encrypted data while the HTTP parser is active causes freed or out-of-bounds heap memory to be read and returned to the client. This flaw leads to information disclosure, potentially exposing sensitive data such as other users\u0027 requests and Transport Layer Security (TLS) private keys.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: Information disclosure via HTTPS parser re-entrancy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important rather than Moderate because an unauthenticated remote attacker can trigger heap memory corruption across concurrent sessions, potentially leaking sensitive data such as private cryptographic keys or request payloads belonging to other users. However, successful exploitation requires high attack complexity, as the target application must implement specific streaming and header-flushing behaviors during request body processing. Node.js deployments serving unencrypted HTTP or terminating TLS at an external gateway remain unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123864"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571836",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571836"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123864",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123864"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123864",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123864"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:17:56.773000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Offload TLS termination to a trusted reverse proxy or load balancer and serve cleartext HTTP from Node.js on localhost only. Restrict direct HTTPS exposure to untrusted clients.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: nodejs: Information disclosure via HTTPS parser re-entrancy"
    },
    {
      "cve": "CVE-2026-123865",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-11-11T18:30:57.527099+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571831"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) through resource exhaustion by permanently leaking server memory and file descriptors. By initiating a connection shutdown and sending a protocol-violating HTTP/2 frame, the internal protocol handler terminates the session without Node.js properly releasing the associated state. Over time, an attacker can accumulate dangling connections, ultimately exhausting server resources and disrupting service availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of service via HTTP/2 session resource leak during shutdown",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because remote, unauthenticated actors can induce memory and file descriptor leaks with minimal effort, resulting in a complete denial of service. Exposure is limited to deployments where Node.js applications directly handle HTTP/2 connections. Applications running standard HTTP/1.1 or those deployed behind front-end reverse proxies that terminate HTTP/2 traffic are not susceptible to this attack.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123865"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571831",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571831"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123865",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123865"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123865",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123865"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:19:36.284000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Terminate HTTP/2 at an upstream reverse proxy and forward HTTP/1.1 to the Node.js backend. Apply connection/rate limits to contain resource exhaustion (see CME-114).",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Denial of service via HTTP/2 session resource leak during shutdown"
    },
    {
      "cve": "CVE-2026-123866",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-11-11T18:31:42.687996+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571844"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A use-after-free vulnerability in the HTTP/2 stream handling mechanism allows for information disclosure. When a stream is terminated while outgoing data is delayed, the server frees the response buffer prematurely while continuing to reference it. A remote attacker can exploit this condition to cause the server to transmit unrelated memory from the heap, potentially exposing sensitive data belonging to other user connections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Information disclosure via use-after-free during HTTP/2 stream teardown",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is classified as an Important severity flaw because an unauthenticated remote attacker can trigger memory disclosure across active connections, potentially exposing confidential data from other users\u0027 sessions. In Red Hat environments, impact is limited to applications that explicitly enable and expose HTTP/2 services, whereas deployments using standard HTTP/1.1 interfaces are unaffected. Under vulnerable configurations, abrupt stream terminations during pending writes allow freed memory segments to be returned over the network socket.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123866"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571844",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571844"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123866",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123866"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123866",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123866"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:21:18.538000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Terminate HTTP/2 at a reverse proxy and avoid exposing Node.js HTTP/2 directly to untrusted peers. Restrict HTTP/2 endpoints to trusted networks (see CME-202).",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Information disclosure via use-after-free during HTTP/2 stream teardown"
    },
    {
      "cve": "CVE-2026-123867",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-11-11T18:31:11.940257+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571835"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. When a Transport Layer Security (TLS) server configures a host-specific client Certificate Authority (CA) without providing an associated server certificate, the per-host client validation settings fail to apply. Consequently, the connection silently falls back to trusting the default client CA. A remote client authorized only for the default host can exploit this flaw to bypass mutual TLS (mTLS) restrictions and gain unauthorized access to protected hostnames.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Mutual TLS authorization bypass via incomplete SNI context configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having Moderate impact because successful exploitation requires a non-standard configuration and existing authorized client credentials, restricting the flaw to cross-tenant boundary traversal rather than arbitrary unauthenticated access. In standard Red Hat enterprise environments, Node.js applications enforcing mutual TLS typically either configure dedicated server certificates for each virtual host or terminate TLS upstream at an API gateway or reverse proxy. The impact is therefore limited to specific deployments that rely on runtime SNI-based client CA switching without defining host-specific server certificates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123867"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571835",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571835"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123867",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123867"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123867",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123867"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:23:12.991000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "When using server.addContext() for per-host client CAs, always include a server certificate in that SNI context so the host-specific CA is applied. Prefer terminating mTLS at a reverse proxy when possible.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Mutual TLS authorization bypass via incomplete SNI context configuration"
    },
    {
      "cve": "CVE-2026-123868",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-11-11T18:31:08.664277+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An unauthenticated remote attacker can cause a denial of service (DoS) by exhausting server memory. By transmitting streams containing numerous small HTTP/2 data frames, incoming data is queued without being properly accounted against session memory limits. This allows an attacker to consume disproportionate amounts of system memory with relatively little network traffic, ultimately causing the server process to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: Denial of service via HTTP/2 memory exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this vulnerability as Moderate severity because, although an unauthenticated remote attacker can trigger a denial of service, the flaw does not compromise data confidentiality or host integrity. Exploitation requires applications to explicitly implement Node.js native HTTP/2 server capabilities to receive untrusted traffic. In standard enterprise deployments, Node.js services are typically fronted by reverse proxies or ingress gateways, or utilize standard HTTP/1.1, which significantly reduces the likelihood of direct remote exposure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123868"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123868",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123868"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123868",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123868"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:25:01.907000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Terminate HTTP/2 at a reverse proxy and limit request body size and concurrent streams (see CME-114). Restrict Node.js HTTP/2 listeners to trusted networks (see CME-202).",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: nodejs: Denial of service via HTTP/2 memory exhaustion"
    },
    {
      "cve": "CVE-2026-123871",
      "cwe": {
        "id": "CWE-209",
        "name": "Generation of Error Message Containing Sensitive Information"
      },
      "discovery_date": "2026-11-11T18:31:32.416575+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571841"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This vulnerability allows information disclosure when invalid proxy configurations trigger error handling routines that fail to redact authentication details. Under these conditions, the application outputs raw proxy URLs containing embedded usernames and passwords to error streams and log services. An unauthorized actor with access to system logs, monitoring outputs, or crash reports can retrieve these credentials to access restricted proxy resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Information disclosure via invalid proxy configuration error messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because sensitive proxy authentication credentials may be exposed to unauthorized observers through application output channels, yet exploitation does not grant direct system compromise or remote code execution. In typical Red Hat Enterprise Linux and OpenShift container deployments, Node.js applications configured with erroneous proxy settings can print intact secrets into standard error streams, shared container logs, or log collectors. Exposure is limited to environments where proxy authentication is configured and specific configuration errors occur during proxy initialization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123871"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571841",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571841"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123871",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123871"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123871",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123871"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:26:51.700000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Avoid placing proxy credentials in the environment of long-lived services; prefer credential helpers or secret stores. Restrict access to logs that may capture ERR_PROXY_INVALID_CONFIG messages.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Information disclosure via invalid proxy configuration error messages"
    },
    {
      "cve": "CVE-2026-123872",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2026-11-11T18:40:49.059233+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571847"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An authenticated remote attacker can bypass client certificate authentication policies on servers configuring different security requirements per hostname. By renegotiating an established Transport Layer Security (TLS) connection and changing the target server name, the attacker can carry forward their existing authenticated session to gain unauthorized access to restricted endpoints.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Client certificate authentication bypass via TLS renegotiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an authenticated attacker can circumvent host-level access controls and reach privileged virtual host endpoints over an existing connection. Exploitation requires non-default architectures where a Node.js process directly handles TLS termination across multi-tenant domains with heterogeneous mutual TLS policies using TLS 1.2. Deployments where TLS is terminated by front-end reverse proxies, ingress routers, or environments utilizing TLS 1.3 exclusively are not exposed to this renegotiation issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123872"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571847",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571847"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123872",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123872"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123872",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123872"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:30:25.193000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Enforce TLS 1.3 to eliminate renegotiation, or terminate TLS at a proxy that does not forward TLS 1.2 renegotiation. Avoid differing per-SNI mTLS policies on one listener when TLS 1.2 remains enabled.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Client certificate authentication bypass via TLS renegotiation"
    },
    {
      "cve": "CVE-2026-123874",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-11-11T18:40:55.938311+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571849"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A use-after-free memory flaw in the HTTP/2 implementation allows an unauthenticated remote attacker to corrupt server memory and cause a Denial of Service (DoS). By sending requests while the server is serving files, an attacker can cause the server to release an active stream object while a write operation is still queued. When the pending write completes, referencing the freed object leads to server memory corruption and terminates the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: Denial of Service via HTTP/2 use-after-free",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having Important impact because an unauthenticated remote attacker can cause memory corruption to terminate network processes, resulting in a denial of service without requiring privileges or user interaction. In typical Red Hat environments hosting Node.js services, the issue specifically impacts deployments using the core HTTP/2 implementation to transmit files directly via file-descriptor-backed streaming methods. Applications that do not enable HTTP/2 servers or handle static file delivery through alternative mechanisms are not exposed to this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571849",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123874"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:32:20.292000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Avoid stream.respondWithFile()/respondWithFD() for untrusted HTTP/2 clients; serve files over HTTP/1.1 or via a reverse proxy. Restrict HTTP/2 file-serving endpoints to trusted networks (see CME-202).",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: nodejs: Denial of Service via HTTP/2 use-after-free"
    },
    {
      "cve": "CVE-2026-123875",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-11-11T18:40:52.535017+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571848"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) by terminating the server process during file transfers. When a client cancels an active file download over an HTTP/2 connection, internal streaming resources are released out of sequence, resulting in an invalid memory access that crashes the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: Denial of Service via cancelled HTTP/2 file downloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because successful exploitation is restricted to denial of service and requires applications to explicitly implement Node.js HTTP/2 file-serving APIs. Applications not utilizing HTTP/2 servers or those handling file delivery through alternative mechanisms are not affected. While an unauthenticated remote client can trigger an abrupt process crash by prematurely aborting in-flight transfers, confidentiality and system integrity are not compromised.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123875"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571848",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571848"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123875",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123875"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123875",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123875"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:33:57.475000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Avoid respondWithFile()/respondWithFD() over HTTP/2 for untrusted clients; use HTTP/1.1 or reverse-proxy file serving instead. Restrict HTTP/2 file endpoints to trusted networks (see CME-202).",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: nodejs: Denial of Service via cancelled HTTP/2 file downloads"
    },
    {
      "cve": "CVE-2026-123877",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-11-11T18:41:13.216536+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571854"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. When managing outbound HTTPS connections, the client connection agent generates identical session-cache keys for requests with differing Certificate Authority (CA) trust configurations. Consequently, an existing Transport Layer Security (TLS) session established under a broad trust policy can be improperly reused by a subsequent request requiring stricter validation. An attacker could exploit this certificate validation bypass to receive confidential data that the application inadvertently transmits to an unauthorized server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: Certificate validation bypass via TLS session cache reuse",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation depends on specific application patterns that share an HTTPS agent between requests using standard system trust stores and requests requiring custom certificate authority constraints. In typical Red Hat enterprise environments, applications usually maintain uniform TLS configurations or employ separate agent instances for sensitive outbound connections with distinct validation requirements. Because successful exploitation necessitates this uncommon agent-sharing pattern alongside precise connection sequencing and network positioning, the overall risk to most deployments remains contained.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-123877"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571854",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571854"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-123877",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-123877"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-123877",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123877"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:28:38.494000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Do not reuse a single https.Agent across requests that use different ca trust policies. Create separate Agents per CA policy, or disable TLS session reuse between divergent policies.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: nodejs: Certificate validation bypass via TLS session cache reuse"
    },
    {
      "cve": "CVE-2026-126051",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-11-11T18:51:01.052085+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2571861"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote, unauthenticated attacker can exploit this vulnerability to cause a denial of service (DoS) by terminating the server process. When a Transport Layer Security (TLS) server is configured with certain handshake callback hooks, it fails to handle situations where the underlying network connection is closed before the deferred callback executes. By sending a specially crafted TLS handshake request immediately followed by a connection closure, an attacker triggers an unhandled exception that crashes the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: Denial of service via premature socket closure during TLS handshake",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this vulnerability as an Important severity flaw because an unauthenticated remote attacker can terminate the Node.js process, leading to a complete denial of service. The issue specifically impacts applications where the Node.js server handles TLS handshakes directly and registers dynamic context or certificate hooks, such as SNI or session resumption callbacks. Deployments where TLS traffic is terminated upstream by a reverse proxy, load balancer, or OpenShift ingress controller do not execute the vulnerable handshake path in Node.js and are not exposed.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
          "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-126051"
        },
        {
          "category": "external",
          "summary": "RHBZ#2571861",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571861"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-126051",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-126051"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-126051",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126051"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
        }
      ],
      "release_date": "2026-11-11T18:35:45.777000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T23:59:19+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99436"
        },
        {
          "category": "workaround",
          "details": "Prefer terminating TLS at a reverse proxy rather than in-process Node.js TLS. If SNICallback, OCSPRequest, newSession/resumeSession, or addContext hooks are unused, avoid configuring them on internet-facing TLS servers.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-devel-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@s390x",
            "Red Hat Hardened Images:nodejs26-libs-1:26.13.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.20.0-1.26.13.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.13.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@s390x",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.13.1.0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: nodejs: Denial of service via premature socket closure during TLS handshake"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.