Security
فارسی
All products

Red Hat Enterprise Linux 10/ubi10/nodejs-24-minimal

Red Hat · Package
18 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-109932 · GHSA-9FM3-97PX-RJF6 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorCVE-2026-87029 · GHSA-55WC-3PG8-JFW6 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109924 · GHSA-4QV8-2P9J-2685 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-109841 · GHSA-F72V-6W45-Q472 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
undici vulnerable to downstream response splitting via retry interceptorCVE-2026-18540 · GHSA-R53P-7PC4-XJ5R undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Low Fix reported
undici vulnerable to Denial of Service via unbounded decompression of compressed responsesCVE-2026-84890 · GHSA-3XPG-4RPP-HHHM undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to caching and replay of unsafe HTTP method responsesCVE-2026-85008 · GHSA-8436-99HF-9MMV undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Low Fix reported
undici vulnerable to response truncation via oversized chunked responses in the dump interceptorCVE-2026-84947 · GHSA-2GQQ-GQF2-X968 undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Low Fix reported
undici vulnerable to Denial of Service via WebSocketStream unclean closeCVE-2026-85014 · GHSA-RX4F-C7P8-82VQ undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionCVE-2026-85024 · GHSA-3WWX-PV8P-Q78V undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Medium Fix reported
node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksCVE-2026-69198 · GHSA-4XRF-JV44-H6HH ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsCVE-2026-59875 · GHSA-GVWX-54WH-QM9J tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
sigstore's `certificateOIDs` verification constraints are silently dropped and never enforcedCVE-2026-48815 · GHSA-52V5-JR5W-GJXR sigstoreExploit Intelligence/sigstore npmRed Hat High Fix reported
http-cache-semantics: http-cache-semantics: Information disclosure via improper Vary header wildcard validationCVE-2026-93750 Confidential Compute Attestation/build-of-trustee/trustee-rhel9Exploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 Red Hat Medium No fix reported