rpm package
almalinux/v8-12.4-devel
pkg:rpm/almalinux/v8-12.4-devel
Vulnerabilities (38)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-59874 | Hig | 7.5 | < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251 | 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251 | Jul 8, 2026 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed | |
| CVE-2026-59873 | Hig | 7.5 | < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251 | 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251 | Jul 8, 2026 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to | |
| CVE-2026-13149 | Hig | — | < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251 | 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251 | Jun 30, 2026 | brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause sign | |
| CVE-2026-48935 | Low | 3.3 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 26, 2026 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. | |
| CVE-2026-48934 | Med | 4.3 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 26, 2026 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. | |
| CVE-2026-48933 | Hig | 7.5 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 26, 2026 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. | |
| CVE-2026-48930 | Cri | 9.8 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 26, 2026 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. | |
| CVE-2026-48928 | Med | 5.4 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 26, 2026 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. | |
| CVE-2026-48619 | Hig | 7.5 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 26, 2026 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. | |
| CVE-2026-48618 | Med | 6.5 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 26, 2026 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security | |
| CVE-2026-48615 | Hig | 7.5 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 26, 2026 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers | |
| CVE-2026-9678 | Med | 5.9 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 17, 2026 | Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the s | |
| CVE-2026-6733 | Low | 3.7 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 17, 2026 | Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request o | |
| CVE-2026-11525 | Low | 3.7 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 17, 2026 | Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. | |
| CVE-2026-12151 | Hig | 7.5 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | Jun 17, 2026 | Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and | |
| CVE-2026-42338 | Med | 6.1 | < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | May 12, 2026 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emi | |
| CVE-2026-21710 | Hig | 7.5 | < 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | Mar 30, 2026 | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, c | |
| CVE-2026-27135 | Hig | 7.5 | < 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | Mar 18, 2026 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the ap | |
| CVE-2026-2229 | Hig | 7.5 | < 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | Mar 12, 2026 | ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-d | |
| CVE-2026-1528 | Hig | 7.5 | < 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | Mar 12, 2026 | ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version |
- affected < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251fixed 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed
- affected < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251fixed 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to
- affected < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251fixed 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause sign
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the s
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request o
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens.
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and
- affected < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47fixed 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emi
- affected < 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37ffixed 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, c
- affected < 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37ffixed 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the ap
- affected < 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37ffixed 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-d
- affected < 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37ffixed 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version
Page 1 of 2