TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g
ip-address: XSS in Address6 HTML-emitting methods
Priority MEDIUM 57
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
RHSA-2026:41947
nodejs:22 security, bug fix, and enhancement update
Released 2026-07-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.aarch64::nodejs:22, nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.ppc64le::nodejs:22, nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.s390x::nodejs:22 +28
Fixes 16 records
TI-2026-36192 CVE-2026-48933 · GHSA-pvpp-9x2p-fxg3
Integer overflow in NodeJS node
Priority MEDIUM 45
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.
TI-2026-36189 CVE-2026-48930 · GHSA-g779-8rvr-37xx
Improper access control in NodeJS node
Priority MEDIUM 42
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.
TI-2026-36196 CVE-2026-48937 · GHSA-p9qf-hwxr-qhff
Uncontrolled resource consumption in NodeJS node
Priority MEDIUM 40
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.
TI-2026-35965 CVE-2026-48619 · GHSA-v3cq-r2f8-qmmc
Uncontrolled resource consumption in NodeJS node
Priority MEDIUM 40
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.
TI-2026-10459 CVE-2026-12151 · GHSA-vxpw-j846-p89q
undici WebSocket client vulnerable to denial of service via fragment count bypass
Priority MEDIUM 40
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.
TI-2026-35963 CVE-2026-48617 · GHSA-rv82-5vqw-69hj
Improper access control in NodeJS node
Priority LOW 36
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.
TI-2026-35964 CVE-2026-48618 · GHSA-g57m-hr98-5m89
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling…
Priority LOW 35
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
TI-2026-35961 CVE-2026-48615 · GHSA-qqjm-7pv6-7q82
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in…
Priority LOW 33
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
TI-2026-08489 CVE-2026-9678 · GHSA-pr7r-676h-xcf6
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
Priority LOW 27
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorizatio…
TI-2026-36187 CVE-2026-48928 · GHSA-3h92-9jcv-8677
Improper access control in NodeJS node
Priority LOW 24
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
TI-2026-36193 CVE-2026-48934 · GHSA-px9q-xv67-75fr
Improper certificate validation in NodeJS node
Priority LOW 20
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
TI-2026-36190 CVE-2026-48931 · GHSA-w88c-7765-q5gg
Time-of-check time-of-use race condition in NodeJS node
Priority LOW 18
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
TI-2026-09954 CVE-2026-11525 · GHSA-g8m3-5g58-fq7m
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
Priority LOW 17
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265.
TI-2026-05899 CVE-2026-6733 · GHSA-35p6-xmwp-9g52
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
Priority LOW 17
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets.
TI-2026-36194 CVE-2026-48935 · GHSA-9qm6-cjgc-f64v
Incorrect default permissions in NodeJS node
Priority LOW 15
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.