{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "ALTNJS-304: backport the Node.js October 2026 security fixes\n- Fix CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069,\n CVE-2026-106072, CVE-2026-106074, CVE-2026-111497\n- Fix CVE-2026-48930, CVE-2026-48618, CVE-2026-48931, carried as prerequisites\n of the October fixes and live bugs in 19.9.0 in their own right\n- CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 do not affect 19.9.0:\n it has neither the ZIP container reader nor the Permission Model\n- Behaviour change (upstream's): TLS now rejects a host that is an IP address\n only after IDNA normalisation, so https://127.1, 0x7f.0.0.1, 0127.0.0.1 and\n 2130706433 no longer validate against any certificate\n- Behaviour change (upstream's): net.connect() now type-checks options.host,\n which 19.9.0 did not; a non-string host throws ERR_INVALID_ARG_TYPE", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_nodejs/el9/advisories/2026/clsa-2026_1792759586.json" } ], "tracking": { "current_release_date": "2026-10-23T12:48:09Z", "generator": { "date": "2026-10-23T12:48:09Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792759586", "initial_release_date": "2026-10-23T12:48:09Z", "revision_history": [ { "date": "2026-10-23T12:48:09Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-nodejs19-nodejs: Fix of 10 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 9", "product": { "name": "Community Enterprise Operating System 9", "product_id": "CentOS-9", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:9:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "product": { "name": "alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "product_id": "alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs19-nodejs-docs@19.9.0-10.el9?arch=noarch&os_name=centos&os_version=9" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64", "product": { "name": "alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64", "product_id": "alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs19-npm@9.6.3-19.9.0.10.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "product": { "name": "alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "product_id": "alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs19-nodejs@19.9.0-10.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "product": { "name": "alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "product_id": "alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs19-nodejs-devel@19.9.0-10.el9?arch=x86_64&os_name=centos&os_version=9" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch" }, "product_reference": "alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" }, "product_reference": "alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64" }, "product_reference": "alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64" }, "product_reference": "alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "relates_to_product_reference": "CentOS-9" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-111497", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-111497" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-105482", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-105482" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-105483", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-105483" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-106074", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-106074" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-105481", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-105481" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-106072", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-106072" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-48930", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "description", "text": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-48930" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" } ], "release_date": "2026-06-26T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-106069", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-106069" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-48931", "cwe": { "id": "CWE-367", "name": "Time-of-check Time-of-use (TOCTOU) Race Condition" }, "notes": [ { "category": "description", "text": "A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-48931" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/07/02/2", "url": "http://www.openwall.com/lists/oss-security/2026/07/02/2" }, { "category": "external", "summary": "https://github.com/nodejs/node/issues/63989", "url": "https://github.com/nodejs/node/issues/63989" }, { "category": "external", "summary": "https://jdstaerk.substack.com/p/nodejs-security-fix-silently-broke", "url": "https://jdstaerk.substack.com/p/nodejs-security-fix-silently-broke" } ], "release_date": "2026-06-22T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-48618", "cwe": { "id": "CWE-176", "name": "Improper Handling of Unicode Encoding" }, "notes": [ { "category": "description", "text": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-48618" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:28727", "url": "https://access.redhat.com/errata/RHSA-2026:28727" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:29012", "url": "https://access.redhat.com/errata/RHSA-2026:29012" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30172", "url": "https://access.redhat.com/errata/RHSA-2026:30172" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35841", "url": "https://access.redhat.com/errata/RHSA-2026:35841" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35842", "url": "https://access.redhat.com/errata/RHSA-2026:35842" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35891", "url": "https://access.redhat.com/errata/RHSA-2026:35891" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35892", "url": "https://access.redhat.com/errata/RHSA-2026:35892" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39246", "url": "https://access.redhat.com/errata/RHSA-2026:39246" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39868", "url": "https://access.redhat.com/errata/RHSA-2026:39868" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41947", "url": "https://access.redhat.com/errata/RHSA-2026:41947" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:52399", "url": "https://access.redhat.com/errata/RHSA-2026:52399" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7378", "url": "https://access.redhat.com/errata/RHSA-2026:7378" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9455", "url": "https://access.redhat.com/errata/RHSA-2026:9455" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-48618", "url": "https://access.redhat.com/security/cve/CVE-2026-48618" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json" } ], "release_date": "2026-06-26T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T12:46:28.179307Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586", "product_ids": [ "CentOS-9:alt-nodejs19-nodejs-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-devel-0:19.9.0-10.el9.x86_64", "CentOS-9:alt-nodejs19-nodejs-docs-0:19.9.0-10.el9.noarch", "CentOS-9:alt-nodejs19-npm-0:9.6.3-19.9.0.10.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792759586" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }