critical
CVE-2026-48930
nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, Photon OS. Rated lower by AlmaLinux (high), Amazon (high), Oracle (high), Rocky Linux (high), Red Hat (medium), Azure Linux (medium), Ubuntu (medium).
Description
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 22.23.0, 24.17.0, 26.3.1 |
| Photon OS 5.0 | nodejs, nodejs-devel | 22.23.3-0.0.1.ph5 |
| alma 10 | nodejs, nodejs-devel, nodejs-docs and 9 more | 1:22.23.1-2.el10_2 and 3 more |
| alma 8 | nodejs:22::nodejs, nodejs:22::nodejs-devel, nodejs:22::nodejs-docs and 17 more | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 and 9 more |
| alma 9 | nodejs:22::nodejs, nodejs:22::nodejs-devel, nodejs:22::nodejs-docs and 17 more | 1:22.23.1-1.module_el9.8.0+276+8b329b47 and 9 more |
| alpine 3.21 | nodejs | 22.23.0-r0 |
| alpine 3.22 | nodejs | 22.23.0-r0 |
| alpine 3.23 | nodejs | 24.17.0-r0 |
| alpine 3.24 | nodejs | 24.17.0-r0 |
| alpine edge | nodejs | 24.17.0-r0 |
| amazon linux 2023 | nodejs22, nodejs22-debuginfo, nodejs22-debugsource and 17 more | 1:22.23.1-1.amzn2023.0.1 and 5 more |
| Azure Linux 3.0 | nodejs | 0:24.17.0-1.azl3 |
Show all 238 entries from 43 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 22.23.0, 24.17.0, 26.3.1 |
| bitnami::Bitnami Vulnerability Database | node-min | 22.23.0, 24.17.0, 26.3.1 |
| Photon OS 5.0 | nodejs | 22.23.3-0.0.1.ph5 |
| Photon OS 5.0 | nodejs-devel | 22.23.3-0.0.1.ph5 |
| alma 10 | nodejs | 1:22.23.1-2.el10_2 |
| alma 10 | nodejs-devel | 1:22.23.1-2.el10_2 |
| alma 10 | nodejs-docs | 1:22.23.1-2.el10_2 |
| alma 10 | nodejs-full-i18n | 1:22.23.1-2.el10_2 |
| alma 10 | nodejs-libs | 1:22.23.1-2.el10_2 |
| alma 10 | nodejs-npm | 1:10.9.8-1.22.23.1.2.el10_2 |
| alma 10 | nodejs24 | 1:24.18.0-1.el10_2 |
| alma 10 | nodejs24-devel | 1:24.18.0-1.el10_2 |
| alma 10 | nodejs24-docs | 1:24.18.0-1.el10_2 |
| alma 10 | nodejs24-full-i18n | 1:24.18.0-1.el10_2 |
| alma 10 | nodejs24-libs | 1:24.18.0-1.el10_2 |
| alma 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.el10_2 |
| alma 8 | nodejs:22::nodejs | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 |
| alma 8 | nodejs:22::nodejs-devel | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 |
| alma 8 | nodejs:22::nodejs-docs | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 |
| alma 8 | nodejs:22::nodejs-full-i18n | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 |
| alma 8 | nodejs:22::nodejs-libs | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 |
| alma 8 | nodejs:22::nodejs-nodemon | 3.0.1-1.module_el8.10.0+3956+47c9ee9f |
| alma 8 | nodejs:22::nodejs-packaging | 2021.06-6.module_el8.10.0+4158+e796f37f |
| alma 8 | nodejs:22::nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4158+e796f37f |
| alma 8 | nodejs:22::npm | 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855 |
| alma 8 | nodejs:22::v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855 |
| alma 8 | nodejs:24::nodejs | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 |
| alma 8 | nodejs:24::nodejs-devel | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 |
| alma 8 | nodejs:24::nodejs-docs | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 |
| alma 8 | nodejs:24::nodejs-full-i18n | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 |
| alma 8 | nodejs:24::nodejs-libs | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 |
| alma 8 | nodejs:24::nodejs-nodemon | 3.0.3-1.module_el8.10.0+4061+f8ceeab9 |
| alma 8 | nodejs:24::nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a |
| alma 8 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a |
| alma 8 | nodejs:24::npm | 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94 |
| alma 8 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94 |
| alma 9 | nodejs:22::nodejs | 1:22.23.1-1.module_el9.8.0+276+8b329b47 |
| alma 9 | nodejs:22::nodejs-devel | 1:22.23.1-1.module_el9.8.0+276+8b329b47 |
| alma 9 | nodejs:22::nodejs-docs | 1:22.23.1-1.module_el9.8.0+276+8b329b47 |
| alma 9 | nodejs:22::nodejs-full-i18n | 1:22.23.1-1.module_el9.8.0+276+8b329b47 |
| alma 9 | nodejs:22::nodejs-libs | 1:22.23.1-1.module_el9.8.0+276+8b329b47 |
| alma 9 | nodejs:22::nodejs-nodemon | 3.0.1-1.module_el9.7.0+208+fb06c0ab |
| alma 9 | nodejs:22::nodejs-packaging | 2021.06-6.module_el9.7.0+227+12323393 |
| alma 9 | nodejs:22::nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+227+12323393 |
| alma 9 | nodejs:22::npm | 1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47 |
| alma 9 | nodejs:22::v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 |
| alma 9 | nodejs:24::nodejs | 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| alma 9 | nodejs:24::nodejs-devel | 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| alma 9 | nodejs:24::nodejs-docs | 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| alma 9 | nodejs:24::nodejs-full-i18n | 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| alma 9 | nodejs:24::nodejs-libs | 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| alma 9 | nodejs:24::nodejs-nodemon | 3.0.3-3.module_el9.7.0+209+ecf6523e |
| alma 9 | nodejs:24::nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e |
| alma 9 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+209+ecf6523e |
| alma 9 | nodejs:24::npm | 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e |
| alma 9 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e |
| alpine 3.21 | nodejs | 22.23.0-r0 |
| alpine 3.22 | nodejs | 22.23.0-r0 |
| alpine 3.23 | nodejs | 24.17.0-r0 |
| alpine 3.24 | nodejs | 24.17.0-r0 |
| alpine edge | nodejs | 24.17.0-r0 |
| amazon linux 2023 | nodejs22 | 1:22.23.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs22-debuginfo | 1:22.23.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs22-debugsource | 1:22.23.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs22-devel | 1:22.23.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs22-docs | 1:22.23.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs22-full-i18n | 1:22.23.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs22-libs | 1:22.23.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs22-libs-debuginfo | 1:22.23.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs22-npm | 1:10.9.8-1.22.23.1.1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24 | 1:24.18.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-debuginfo | 1:24.18.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-debugsource | 1:24.18.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-devel | 1:24.18.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-docs | 1:24.18.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-full-i18n | 1:24.18.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-libs | 1:24.18.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-libs-debuginfo | 1:24.18.0-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.amzn2023.0.1 |
| amazon linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.amzn2023.0.1 |
| amazon linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.amzn2023.0.1 |
| Azure Linux 3.0 | nodejs | 0:24.17.0-1.azl3 |
| debian 11 | nodejs | no fix listed |
| debian 12 | nodejs | 18.20.4+dfsg-1~deb12u3 |
| debian 13 | nodejs | 20.19.2+dfsg-1+deb13u3 |
| debian 14 | nodejs | 24.17.0+dfsg+~cs24.13.2-1 |
| echo | nodejs | 18.20.4+dfsg-1~deb12u3 |
| minimos | nodejs-22 | 22.23.0-r0 |
| minimos | nodejs-24 | 24.17.0-r0 |
| minimos | nodejs-26 | 26.3.1-r0 |
| Oracle Linux 8 | nodejs | 1:24.18.0-1.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | nodejs-devel | 1:24.18.0-1.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | nodejs-docs | 1:24.18.0-1.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | nodejs-full-i18n | 1:24.18.0-1.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | nodejs-libs | 1:24.18.0-1.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.3-1.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-6.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | npm | 1:11.16.0-1.24.18.0.1.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+90968+e271b286 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+90961+a86f8457 |
| Oracle Linux 9 | nodejs | 1:24.18.0-1.module+el9.8.0+90946+13dc792a |
| Oracle Linux 9 | nodejs-devel | 1:24.18.0-1.module+el9.8.0+90946+13dc792a |
| Oracle Linux 9 | nodejs-docs | 1:24.18.0-1.module+el9.8.0+90946+13dc792a |
| Oracle Linux 9 | nodejs-full-i18n | 1:24.18.0-1.module+el9.8.0+90946+13dc792a |
| Oracle Linux 9 | nodejs-libs | 1:24.18.0-1.module+el9.8.0+90946+13dc792a |
| Oracle Linux 9 | nodejs-nodemon | 3.0.3-3.module+el9.8.0+90946+13dc792a |
| Oracle Linux 9 | nodejs-packaging | 2021.06-6.module+el9.8.0+90947+d3e8e647 |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-6.module+el9.8.0+90947+d3e8e647 |
| Oracle Linux 9 | npm | 1:11.16.0-1.24.18.0.1.module+el9.8.0+90946+13dc792a |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+90947+d3e8e647 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+90946+13dc792a |
| rapidfort alma 10 | nodejs | 1:22.23.1-2.el10_0, 1:22.23.1-2.el10_2 |
| rapidfort alma 10 | nodejs-devel | 1:22.23.1-2.el10_0, 1:22.23.1-2.el10_2 |
| rapidfort alma 10 | nodejs-docs | 1:22.23.1-2.el10_0, 1:22.23.1-2.el10_2 |
| rapidfort alma 10 | nodejs-full-i18n | 1:22.23.1-2.el10_0, 1:22.23.1-2.el10_2 |
| rapidfort alma 10 | nodejs-libs | 1:22.23.1-2.el10_0, 1:22.23.1-2.el10_2 |
| rapidfort alma 10 | nodejs-npm | 1:10.9.8-1.22.23.1.2.el10_0, 1:10.9.8-1.22.23.1.2.el10_2 |
| rapidfort alma 10 | nodejs24 | 1:24.18.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-devel | 1:24.18.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-docs | 1:24.18.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-full-i18n | 1:24.18.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-libs | 1:24.18.0-1.el10_2 |
| rapidfort alma 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.el10_2 |
| rapidfort alma 9 | nodejs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa, 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| rapidfort alma 9 | nodejs-docs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa, 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| rapidfort alma 9 | nodejs-full-i18n | 1:22.23.1-1.module+el9.8.0+24457+996af7aa, 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| rapidfort alma 9 | nodejs-libs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa, 1:24.18.0-1.module_el9.8.0+277+61fc613e |
| rapidfort alma 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.8.0+24156+bb41d456, 3.0.3-3.module_el9.7.0+209+ecf6523e |
| rapidfort alma 9 | npm | 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa, 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e |
| rapidfort alpine 3.20 | nodejs | 22.23.0-r0 |
| rapidfort alpine 3.21 | nodejs | 22.23.0-r0 |
| rapidfort alpine 3.22 | nodejs | 22.23.0-r0 |
| rapidfort alpine 3.23 | nodejs | 22.23.0-r0 |
| rapidfort alpine 3.24 | nodejs | 22.23.0-r0 |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | nodejs20 | no fix listed |
| rapidfort amazon linux 2023 | nodejs20-typescript | no fix listed |
| rapidfort amazon linux 2023 | nodejs22 | 1:22.23.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs22-devel | 1:22.23.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs22-docs | 1:22.23.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs22-full-i18n | 1:22.23.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs22-libs | 1:22.23.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs22-npm | 1:10.9.8-1.22.23.1.1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24 | 1:24.18.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-devel | 1:24.18.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-docs | 1:24.18.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-full-i18n | 1:24.18.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-libs | 1:24.18.0-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.amzn2023.0.1 |
| rapidfort debian 12 | nodejs | 0:18.20.4+dfsg-1~deb12u3, 0:20.19.2+dfsg-1+deb13u3, 0:24.17.0+dfsg+~cs24.13.2-1 |
| rapidfort debian 13 | nodejs | 0:18.20.4+dfsg-1~deb12u3, 0:20.19.2+dfsg-1+deb13u3, 0:24.17.0+dfsg+~cs24.13.2-1 |
| rapidfort fedora 43 | nodejs | 1:22.22.2-3.fc43 |
| rapidfort Oracle Linux 10 | nodejs | 1:22.23.1-2.el10_2 |
| rapidfort Oracle Linux 10 | nodejs-devel | 1:22.23.1-2.el10_2 |
| rapidfort Oracle Linux 10 | nodejs-docs | 1:22.23.1-2.el10_2 |
| rapidfort Oracle Linux 10 | nodejs-full-i18n | 1:22.23.1-2.el10_2 |
| rapidfort Oracle Linux 10 | nodejs-libs | 1:22.23.1-2.el10_2 |
| rapidfort Oracle Linux 10 | nodejs-npm | 1:10.9.8-1.22.23.1.2.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24 | 1:24.18.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-devel | 1:24.18.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-docs | 1:24.18.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-full-i18n | 1:24.18.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-libs | 1:24.18.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.0.1.el10_2 |
| rapidfort Oracle Linux 9 | nodejs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Oracle Linux 9 | nodejs-devel | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.8.0+24156+bb41d456 |
| rapidfort Oracle Linux 9 | npm | 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa |
| rapidfort Red Hat 9 | nodejs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Red Hat 9 | nodejs-docs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Red Hat 9 | nodejs-full-i18n | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Red Hat 9 | nodejs-libs | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.8.0+24156+bb41d456 |
| rapidfort Red Hat 9 | npm | 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa |
| rapidfort rocky 9 | nodejs | 1:22.23.1-1.module+el9.8.0+40240+779db2c0 |
| rapidfort rocky 9 | nodejs-full-i18n | 1:22.23.1-1.module+el9.8.0+40240+779db2c0 |
| rapidfort rocky 9 | nodejs-libs | 1:22.23.1-1.module+el9.8.0+40240+779db2c0 |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40153+4d595597 |
| rapidfort rocky 9 | npm | 1:10.9.8-1.22.23.1.1.module+el9.8.0+40240+779db2c0 |
| rapidfort ubuntu 20.04 | nodejs | 0:20.19.5-1nodesource1, 0:22.22.2-1nodesource1 |
| rapidfort ubuntu 20.04 | rf-nodejs | 0:20.19.5-1nodesource1, 0:22.22.2-1nodesource1, 0:24.17.0+dfsg+~cs24.13.2-1 |
| rapidfort ubuntu 22.04 | nodejs | 0:20.19.5-1nodesource1, 0:22.22.2-1nodesource1 |
| rapidfort ubuntu 22.04 | rf-nodejs | 0:20.19.5-1nodesource1, 0:22.22.2-1nodesource1, 0:24.17.0+dfsg+~cs24.13.2-1 |
| rapidfort ubuntu 24.04 | nodejs | 0:20.19.5-1nodesource1, 0:22.22.2-1nodesource1 |
| rapidfort ubuntu 24.04 | rf-nodejs | 0:20.19.5-1nodesource1, 0:22.22.2-1nodesource1, 0:24.17.0+dfsg+~cs24.13.2-1 |
| Red Hat | nodejs:26::nodejs | no fix listed |
| Red Hat | nodejs:26::nodejs-docs | no fix listed |
| Red Hat | nodejs:26::nodejs-full-i18n | no fix listed |
| Red Hat | nodejs:26::nodejs-libs | no fix listed |
| Red Hat | nodejs:26::npm | no fix listed |
| rocky 10 | nodejs | 1:22.23.1-2.el10_2 |
| rocky 10 | nodejs-devel | 1:22.23.1-2.el10_2 |
| rocky 10 | nodejs-docs | 1:22.23.1-2.el10_2 |
| rocky 10 | nodejs-full-i18n | 1:22.23.1-2.el10_2 |
| rocky 10 | nodejs-libs | 1:22.23.1-2.el10_2 |
| rocky 10 | nodejs-npm | 1:10.9.8-1.22.23.1.2.el10_2 |
| rocky 10 | nodejs24 | 1:24.18.0-1.el10_2 |
| rocky 10 | nodejs24-devel | 1:24.18.0-1.el10_2 |
| rocky 10 | nodejs24-docs | 1:24.18.0-1.el10_2 |
| rocky 10 | nodejs24-full-i18n | 1:24.18.0-1.el10_2 |
| rocky 10 | nodejs24-libs | 1:24.18.0-1.el10_2 |
| rocky 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.el10_2 |
| rocky 8 | nodejs:22::nodejs | 1:22.23.1-1.module+el8.10.0+40256+2fd2ac14 |
| rocky 8 | nodejs:22::nodejs-devel | 1:22.23.1-1.module+el8.10.0+40256+2fd2ac14 |
| rocky 8 | nodejs:22::nodejs-docs | 1:22.23.1-1.module+el8.10.0+40256+2fd2ac14 |
| rocky 8 | nodejs:22::nodejs-full-i18n | 1:22.23.1-1.module+el8.10.0+40256+2fd2ac14 |
| rocky 8 | nodejs:22::nodejs-libs | 1:22.23.1-1.module+el8.10.0+40256+2fd2ac14 |
| rocky 8 | nodejs:22::nodejs-nodemon | 3.0.1-1.module+el8.9.0+1760+903d54b9 |
| rocky 8 | nodejs:22::nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 |
| rocky 8 | nodejs:22::nodejs-packaging-bundler | 2021.06-6.module+el8.10.0+40172+38f6fdd1 |
| rocky 8 | nodejs:22::npm | 1:10.9.8-1.22.23.1.1.module+el8.10.0+40256+2fd2ac14 |
| rocky 8 | nodejs:22::v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+40256+2fd2ac14 |
| rocky 8 | nodejs:24::nodejs | 1:24.18.0-1.module+el8.10.0+40252+a58646bc |
| rocky 8 | nodejs:24::nodejs-devel | 1:24.18.0-1.module+el8.10.0+40252+a58646bc |
| rocky 8 | nodejs:24::nodejs-docs | 1:24.18.0-1.module+el8.10.0+40252+a58646bc |
| rocky 8 | nodejs:24::nodejs-full-i18n | 1:24.18.0-1.module+el8.10.0+40252+a58646bc |
| rocky 8 | nodejs:24::nodejs-libs | 1:24.18.0-1.module+el8.10.0+40252+a58646bc |
| rocky 8 | nodejs:24::nodejs-nodemon | 3.0.3-1.module+el8.10.0+2084+ab509703 |
| rocky 8 | nodejs:24::nodejs-packaging | 2021.06-6.module+el8.10.0+40171+8fa9c325 |
| rocky 8 | nodejs:24::nodejs-packaging-bundler | 2021.06-6.module+el8.10.0+40172+38f6fdd1 |
| rocky 8 | nodejs:24::npm | 1:11.16.0-1.24.18.0.1.module+el8.10.0+40252+a58646bc |
| rocky 8 | nodejs:24::v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+40252+a58646bc |
| rocky 9 | nodejs:22::nodejs | 1:22.23.1-1.module+el9.8.0+40240+779db2c0 |
| rocky 9 | nodejs:22::nodejs-devel | 1:22.23.1-1.module+el9.8.0+40240+779db2c0 |
| rocky 9 | nodejs:22::nodejs-docs | 1:22.23.1-1.module+el9.8.0+40240+779db2c0 |
| rocky 9 | nodejs:22::nodejs-full-i18n | 1:22.23.1-1.module+el9.8.0+40240+779db2c0 |
| rocky 9 | nodejs:22::nodejs-libs | 1:22.23.1-1.module+el9.8.0+40240+779db2c0 |
| rocky 9 | nodejs:22::nodejs-nodemon | 3.0.1-1.module+el9.7.0+40022+9ecc286c |
| rocky 9 | nodejs:22::nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 |
| rocky 9 | nodejs:22::nodejs-packaging-bundler | 2021.06-6.module+el9.7.0+40153+4d595597 |
| rocky 9 | nodejs:22::npm | 1:10.9.8-1.22.23.1.1.module+el9.8.0+40240+779db2c0 |
| rocky 9 | nodejs:22::v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+40240+779db2c0 |
| rocky 9 | nodejs:22::v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+40241+ba7fe110 |
| ubuntu 24.04 | nodejs | no fix listed |
References
- https://access.redhat.com/errata/RHSA-2026:35892
- https://access.redhat.com/security/cve/CVE-2026-48930
- https://bugzilla.redhat.com/2476810
- https://bugzilla.redhat.com/2489980
- https://bugzilla.redhat.com/2490000
- https://bugzilla.redhat.com/2490006
- https://bugzilla.redhat.com/2490008
- https://bugzilla.redhat.com/2493325
All 52 references
- https://bugzilla.redhat.com/2493326
- https://bugzilla.redhat.com/2493329
- https://bugzilla.redhat.com/2493331
- https://bugzilla.redhat.com/2493332
- https://bugzilla.redhat.com/2493333
- https://bugzilla.redhat.com/2493335
- https://bugzilla.redhat.com/2493337
- https://bugzilla.redhat.com/show_bug.cgi?id=2476810
- https://bugzilla.redhat.com/show_bug.cgi?id=2489980
- https://bugzilla.redhat.com/show_bug.cgi?id=2490000
- https://bugzilla.redhat.com/show_bug.cgi?id=2490006
- https://bugzilla.redhat.com/show_bug.cgi?id=2490008
- https://bugzilla.redhat.com/show_bug.cgi?id=2493325
- https://bugzilla.redhat.com/show_bug.cgi?id=2493326
- https://bugzilla.redhat.com/show_bug.cgi?id=2493329
- https://bugzilla.redhat.com/show_bug.cgi?id=2493331
- https://bugzilla.redhat.com/show_bug.cgi?id=2493332
- https://bugzilla.redhat.com/show_bug.cgi?id=2493333
- https://bugzilla.redhat.com/show_bug.cgi?id=2493335
- https://bugzilla.redhat.com/show_bug.cgi?id=2493337
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11525
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12151
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48615
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48618
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48619
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48928
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48930
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48933
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48934
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48935
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6733
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9678
- https://errata.almalinux.org/9/ALSA-2026-35892.html
- https://errata.rockylinux.org/RLSA-2026:35892
- https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e
- https://hackerone.com/reports/3656716
- https://linux.oracle.com/cve/CVE-2026-48930.html
- https://linux.oracle.com/errata/ELSA-2026-41947.html
- https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
- https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#embedded-nul-hostnames-can-lead-to-silent-authority-rebinding-due-to-c-string-truncation-in-resolver-bindings-cve-2026-48930---medium
- https://nvd.nist.gov/vuln/detail/CVE-2026-48930
- https://www.cve.org/CVERecord?id=CVE-2026-48930