TI-2026-08342 CVE-2026-9496 · GHSA-w4pp-8pjf-rmxw
Regular expression denial of service in pacote
Priority HIGH 77
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function.
RHSA-2026:76750
nodejs:22 security update
Released 2026-10-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.2-2.module+el9.8.0+24958+80b2ac6e.aarch64::nodejs:22, nodejs-1:22.23.2-2.module+el9.8.0+24958+80b2ac6e.ppc64le::nodejs:22, nodejs-1:22.23.2-2.module+el9.8.0+24958+80b2ac6e.s390x::nodejs:22 +28
Fixes 2 records
TI-2026-15892 CVE-2026-19534 · GHSA-rfgv-xxqx-mfg5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
Priority LOW 39
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested.