TI-2026-48541 CVE-2026-69192 · GHSA-mwp4-54f8-5fhr
Improper input validation in beaugunderson ip-address
Priority HIGH 75
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
RHSA-2026:62416
nodejs:22 security update
Released 2026-09-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64::nodejs:22, nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le::nodejs:22, nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x::nodejs:22 +28
Fixes 16 records
TI-2026-48532 CVE-2026-69152 · GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Priority HIGH 72
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-39172 CVE-2026-54272 · GHSA-22jq-vg5j-6vgg
ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
Priority HIGH 70
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
TI-2026-40990 CVE-2026-56848 · GHSA-679w-638g-xf9h
Use after free in NodeJS node
Priority MEDIUM 40
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.
TI-2026-12072 CVE-2026-14257 · GHSA-mh99-v99m-4gvg
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Priority MEDIUM 40
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.
TI-2026-40988 CVE-2026-56846 · GHSA-frc8-j9wv-2348
Uncontrolled resource consumption in NodeJS node
Priority LOW 39
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.
TI-2026-10207 CVE-2026-11824 · GHSA-8g48-4wfm-7247
SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate
Priority LOW 38
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…
TI-2026-41798 CVE-2026-58043 · GHSA-qrq2-c54w-wgqm
Improper access control in NodeJS node
Priority LOW 37
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
TI-2026-10205 CVE-2026-11822 · GHSA-6qj8-gw6p-hc5p
SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek
Priority LOW 31
SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.
TI-2026-41795 CVE-2026-58040 · GHSA-r5cq-rcm7-54x2
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips…
Priority LOW 28
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).
TI-2026-41800 CVE-2026-58045 · GHSA-4j79-vxj3-vjvm
Uncontrolled resource consumption in NodeJS node
Priority LOW 27
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash.
TI-2026-41797 CVE-2026-58042 · GHSA-pgf6-87r4-94vm
Uncontrolled resource consumption in NodeJS node
Priority LOW 27
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
TI-2026-40989 CVE-2026-56847 · GHSA-hw7r-7v27-7388
A flaw in Node.js Permission Model enforcement allows…
Priority LOW 26
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.
TI-2026-40991 CVE-2026-56850 · GHSA-777r-4cwx-g26v
Improper authentication in NodeJS node
Priority LOW 19
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
TI-2026-41799 CVE-2026-58044 · GHSA-6hff-9f4h-85xm
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based…
Priority LOW 17
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused…
TI-2026-41794 CVE-2026-58039 · GHSA-4qw5-6jhx-9hfx
Improper access control in NodeJS node
Priority LOW 15
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.