{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-27135 nghttp2 Denial of service: Assertion failure due to the missing state validation - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-27135.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "nghttp2 Denial of service: Assertion failure due to the missing state validation",
    "tracking": {
      "current_release_date": "2026-03-27T01:41:20.000Z",
      "generator": {
        "date": "2026-03-27T07:08:42.915Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-27135",
      "initial_release_date": "2026-03-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-03-20T01:02:06.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-03-21T01:02:12.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2026-03-21T01:37:11.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        },
        {
          "date": "2026-03-25T14:36:49.000Z",
          "legacy_version": "4",
          "number": "4",
          "summary": "Information published."
        },
        {
          "date": "2026-03-27T01:41:20.000Z",
          "legacy_version": "5",
          "number": "5",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 nghttp2 1.61.0-2",
                "product": {
                  "name": "\u003cazl3 nghttp2 1.61.0-2",
                  "product_id": "8"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 nghttp2 1.61.0-2",
                "product": {
                  "name": "azl3 nghttp2 1.61.0-2",
                  "product_id": "20318"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 nghttp2 1.57.0-2",
                "product": {
                  "name": "\u003ccbl2 nghttp2 1.57.0-2",
                  "product_id": "9"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 nghttp2 1.57.0-2",
                "product": {
                  "name": "cbl2 nghttp2 1.57.0-2",
                  "product_id": "19774"
                }
              }
            ],
            "category": "product_name",
            "name": "nghttp2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 cmake 3.30.3-12",
                "product": {
                  "name": "\u003cazl3 cmake 3.30.3-12",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 cmake 3.30.3-12",
                "product": {
                  "name": "azl3 cmake 3.30.3-12",
                  "product_id": "20974"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 cmake 3.21.4-21",
                "product": {
                  "name": "\u003ccbl2 cmake 3.21.4-21",
                  "product_id": "6"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 cmake 3.21.4-21",
                "product": {
                  "name": "cbl2 cmake 3.21.4-21",
                  "product_id": "20870"
                }
              }
            ],
            "category": "product_name",
            "name": "cmake"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 nodejs 20.14.0-13",
                "product": {
                  "name": "\u003cazl3 nodejs 20.14.0-13",
                  "product_id": "7"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 nodejs 20.14.0-13",
                "product": {
                  "name": "azl3 nodejs 20.14.0-13",
                  "product_id": "20866"
                }
              }
            ],
            "category": "product_name",
            "name": "nodejs"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 nodejs18 18.20.3-11",
                "product": {
                  "name": "\u003ccbl2 nodejs18 18.20.3-11",
                  "product_id": "5"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 nodejs18 18.20.3-11",
                "product": {
                  "name": "cbl2 nodejs18 18.20.3-11",
                  "product_id": "20894"
                }
              }
            ],
            "category": "product_name",
            "name": "nodejs18"
          },
          {
            "category": "product_name",
            "name": "azl3 rust 1.75.0-25",
            "product": {
              "name": "azl3 rust 1.75.0-25",
              "product_id": "3"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 rust 1.90.0-4",
            "product": {
              "name": "azl3 rust 1.90.0-4",
              "product_id": "2"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 rust 1.72.0-14",
            "product": {
              "name": "cbl2 rust 1.72.0-14",
              "product_id": "4"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 nghttp2 1.61.0-2 as a component of Azure Linux 3.0",
          "product_id": "17084-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nghttp2 1.61.0-2 as a component of Azure Linux 3.0",
          "product_id": "20318-17084"
        },
        "product_reference": "20318",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 cmake 3.30.3-12 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 cmake 3.30.3-12 as a component of Azure Linux 3.0",
          "product_id": "20974-17084"
        },
        "product_reference": "20974",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 nodejs 20.14.0-13 as a component of Azure Linux 3.0",
          "product_id": "17084-7"
        },
        "product_reference": "7",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nodejs 20.14.0-13 as a component of Azure Linux 3.0",
          "product_id": "20866-17084"
        },
        "product_reference": "20866",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 rust 1.75.0-25 as a component of Azure Linux 3.0",
          "product_id": "17084-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 rust 1.90.0-4 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 cmake 3.21.4-21 as a component of CBL Mariner 2.0",
          "product_id": "17086-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cmake 3.21.4-21 as a component of CBL Mariner 2.0",
          "product_id": "20870-17086"
        },
        "product_reference": "20870",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 nghttp2 1.57.0-2 as a component of CBL Mariner 2.0",
          "product_id": "17086-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 nghttp2 1.57.0-2 as a component of CBL Mariner 2.0",
          "product_id": "19774-17086"
        },
        "product_reference": "19774",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 nodejs18 18.20.3-11 as a component of CBL Mariner 2.0",
          "product_id": "17086-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 nodejs18 18.20.3-11 as a component of CBL Mariner 2.0",
          "product_id": "20894-17086"
        },
        "product_reference": "20894",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 rust 1.72.0-14 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17084-3",
            "17084-2",
            "17086-4"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "20318-17084",
          "20974-17084",
          "20866-17084",
          "20870-17086",
          "19774-17086",
          "20894-17086"
        ],
        "known_affected": [
          "17084-8",
          "17084-1",
          "17084-7",
          "17086-6",
          "17086-9",
          "17086-5"
        ],
        "known_not_affected": [
          "17084-3",
          "17084-2",
          "17086-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27135 nghttp2 Denial of service: Assertion failure due to the missing state validation - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-27135.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "1.61.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-8"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "3.30.3-13:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "20.14.0-14:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-7"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "3.21.4-23:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-6"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "1.57.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-9"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "18.20.3-12:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-5"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalsScore": 0.0,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "17084-8",
            "17084-1",
            "17084-7",
            "17086-6",
            "17086-9",
            "17086-5"
          ]
        }
      ],
      "title": "nghttp2 Denial of service: Assertion failure due to the missing state validation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "libnghttp2-14-1.68.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the libnghttp2-14-1.68.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10437",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10437-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "libnghttp2-14-1.68.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-03-26T00:00:00Z",
      "generator": {
        "date": "2026-03-26T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10437-1",
      "initial_release_date": "2026-03-26T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-03-26T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.68.1-1.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.68.1-1.1.aarch64",
                  "product_id": "libnghttp2-14-1.68.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.68.1-1.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-32bit-1.68.1-1.1.aarch64",
                  "product_id": "libnghttp2-14-32bit-1.68.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.68.1-1.1.aarch64",
                "product": {
                  "name": "libnghttp2-devel-1.68.1-1.1.aarch64",
                  "product_id": "libnghttp2-devel-1.68.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.68.1-1.1.aarch64",
                "product": {
                  "name": "nghttp2-1.68.1-1.1.aarch64",
                  "product_id": "nghttp2-1.68.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-doc-1.68.1-1.1.aarch64",
                "product": {
                  "name": "nghttp2-doc-1.68.1-1.1.aarch64",
                  "product_id": "nghttp2-doc-1.68.1-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.68.1-1.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.68.1-1.1.ppc64le",
                  "product_id": "libnghttp2-14-1.68.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.68.1-1.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-32bit-1.68.1-1.1.ppc64le",
                  "product_id": "libnghttp2-14-32bit-1.68.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.68.1-1.1.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-1.68.1-1.1.ppc64le",
                  "product_id": "libnghttp2-devel-1.68.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.68.1-1.1.ppc64le",
                "product": {
                  "name": "nghttp2-1.68.1-1.1.ppc64le",
                  "product_id": "nghttp2-1.68.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-doc-1.68.1-1.1.ppc64le",
                "product": {
                  "name": "nghttp2-doc-1.68.1-1.1.ppc64le",
                  "product_id": "nghttp2-doc-1.68.1-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.68.1-1.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.68.1-1.1.s390x",
                  "product_id": "libnghttp2-14-1.68.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.68.1-1.1.s390x",
                "product": {
                  "name": "libnghttp2-14-32bit-1.68.1-1.1.s390x",
                  "product_id": "libnghttp2-14-32bit-1.68.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.68.1-1.1.s390x",
                "product": {
                  "name": "libnghttp2-devel-1.68.1-1.1.s390x",
                  "product_id": "libnghttp2-devel-1.68.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.68.1-1.1.s390x",
                "product": {
                  "name": "nghttp2-1.68.1-1.1.s390x",
                  "product_id": "nghttp2-1.68.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-doc-1.68.1-1.1.s390x",
                "product": {
                  "name": "nghttp2-doc-1.68.1-1.1.s390x",
                  "product_id": "nghttp2-doc-1.68.1-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.68.1-1.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.68.1-1.1.x86_64",
                  "product_id": "libnghttp2-14-1.68.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.68.1-1.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-32bit-1.68.1-1.1.x86_64",
                  "product_id": "libnghttp2-14-32bit-1.68.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.68.1-1.1.x86_64",
                "product": {
                  "name": "libnghttp2-devel-1.68.1-1.1.x86_64",
                  "product_id": "libnghttp2-devel-1.68.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.68.1-1.1.x86_64",
                "product": {
                  "name": "nghttp2-1.68.1-1.1.x86_64",
                  "product_id": "nghttp2-1.68.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-doc-1.68.1-1.1.x86_64",
                "product": {
                  "name": "nghttp2-doc-1.68.1-1.1.x86_64",
                  "product_id": "nghttp2-doc-1.68.1-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.68.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.68.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.68.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.68.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.68.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.68.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.68.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.68.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.68.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.aarch64"
        },
        "product_reference": "libnghttp2-14-32bit-1.68.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.68.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-32bit-1.68.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.68.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.s390x"
        },
        "product_reference": "libnghttp2-14-32bit-1.68.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.68.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.68.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.68.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.68.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.68.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.68.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.68.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.68.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.68.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.68.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.68.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.aarch64"
        },
        "product_reference": "nghttp2-1.68.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.68.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.ppc64le"
        },
        "product_reference": "nghttp2-1.68.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.68.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.s390x"
        },
        "product_reference": "nghttp2-1.68.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.68.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.x86_64"
        },
        "product_reference": "nghttp2-1.68.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-doc-1.68.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.aarch64"
        },
        "product_reference": "nghttp2-doc-1.68.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-doc-1.68.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.ppc64le"
        },
        "product_reference": "nghttp2-doc-1.68.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-doc-1.68.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.s390x"
        },
        "product_reference": "nghttp2-doc-1.68.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-doc-1.68.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.x86_64"
        },
        "product_reference": "nghttp2-doc-1.68.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.aarch64",
          "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.ppc64le",
          "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.s390x",
          "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.x86_64",
          "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.aarch64",
          "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.ppc64le",
          "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.s390x",
          "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.x86_64",
          "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.aarch64",
          "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.ppc64le",
          "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.s390x",
          "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.x86_64",
          "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.aarch64",
          "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.s390x",
          "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.x86_64",
          "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.aarch64",
          "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.ppc64le",
          "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.s390x",
          "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.x86_64",
            "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.x86_64",
            "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.x86_64",
            "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.x86_64",
            "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:libnghttp2-14-1.68.1-1.1.x86_64",
            "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:libnghttp2-14-32bit-1.68.1-1.1.x86_64",
            "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:libnghttp2-devel-1.68.1-1.1.x86_64",
            "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:nghttp2-1.68.1-1.1.x86_64",
            "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.aarch64",
            "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.ppc64le",
            "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.s390x",
            "openSUSE Tumbleweed:nghttp2-doc-1.68.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issue:\n\n- CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-432",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20413-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-03-24T12:30:27Z",
      "generator": {
        "date": "2026-03-24T12:30:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20413-1",
      "initial_release_date": "2026-03-24T12:30:27Z",
      "revision_history": [
        {
          "date": "2026-03-24T12:30:27Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-160000.3.1.aarch64",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-160000.3.1.aarch64",
                  "product_id": "libnghttp2-devel-1.64.0-160000.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-160000.3.1.aarch64",
                "product": {
                  "name": "nghttp2-1.64.0-160000.3.1.aarch64",
                  "product_id": "nghttp2-1.64.0-160000.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
                  "product_id": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-160000.3.1.ppc64le",
                "product": {
                  "name": "nghttp2-1.64.0-160000.3.1.ppc64le",
                  "product_id": "nghttp2-1.64.0-160000.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.s390x",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-160000.3.1.s390x",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-160000.3.1.s390x",
                  "product_id": "libnghttp2-devel-1.64.0-160000.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-160000.3.1.s390x",
                "product": {
                  "name": "nghttp2-1.64.0-160000.3.1.s390x",
                  "product_id": "nghttp2-1.64.0-160000.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-160000.3.1.x86_64",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-160000.3.1.x86_64",
                  "product_id": "libnghttp2-devel-1.64.0-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-160000.3.1.x86_64",
                "product": {
                  "name": "nghttp2-1.64.0-160000.3.1.x86_64",
                  "product_id": "nghttp2-1.64.0-160000.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T12:30:27Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issue:\n\n- CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SL-Micro-6.2-432",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20833-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20833-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620833-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20833-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/025004.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-03-24T12:31:51Z",
      "generator": {
        "date": "2026-03-24T12:31:51Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20833-1",
      "initial_release_date": "2026-03-24T12:31:51Z",
      "revision_history": [
        {
          "date": "2026-03-24T12:31:51Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.s390x",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.2",
                "product": {
                  "name": "SUSE Linux Micro 6.2",
                  "product_id": "SUSE Linux Micro 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:transactional"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.aarch64",
          "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
          "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.s390x",
          "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libnghttp2-14-1.64.0-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T12:31:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issue:\n\n- CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-645,SUSE-SLE-Micro-6.1-464",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20950-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20950-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620950-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20950-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045289.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-03-27T09:43:31Z",
      "generator": {
        "date": "2026-03-27T09:43:31Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20950-1",
      "initial_release_date": "2026-03-27T09:43:31Z",
      "revision_history": [
        {
          "date": "2026-03-27T09:43:31Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-309-9.1.aarch64",
                "product": {
                  "name": "cockpit-309-9.1.aarch64",
                  "product_id": "cockpit-309-9.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-bridge-309-9.1.aarch64",
                "product": {
                  "name": "cockpit-bridge-309-9.1.aarch64",
                  "product_id": "cockpit-bridge-309-9.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ws-309-9.1.aarch64",
                "product": {
                  "name": "cockpit-ws-309-9.1.aarch64",
                  "product_id": "cockpit-ws-309-9.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64",
                  "product_id": "libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-networkmanager-309-9.1.noarch",
                "product": {
                  "name": "cockpit-networkmanager-309-9.1.noarch",
                  "product_id": "cockpit-networkmanager-309-9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-selinux-309-9.1.noarch",
                "product": {
                  "name": "cockpit-selinux-309-9.1.noarch",
                  "product_id": "cockpit-selinux-309-9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-storaged-309-9.1.noarch",
                "product": {
                  "name": "cockpit-storaged-309-9.1.noarch",
                  "product_id": "cockpit-storaged-309-9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-system-309-9.1.noarch",
                "product": {
                  "name": "cockpit-system-309-9.1.noarch",
                  "product_id": "cockpit-system-309-9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le",
                  "product_id": "libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-309-9.1.s390x",
                "product": {
                  "name": "cockpit-309-9.1.s390x",
                  "product_id": "cockpit-309-9.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-bridge-309-9.1.s390x",
                "product": {
                  "name": "cockpit-bridge-309-9.1.s390x",
                  "product_id": "cockpit-bridge-309-9.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ws-309-9.1.s390x",
                "product": {
                  "name": "cockpit-ws-309-9.1.s390x",
                  "product_id": "cockpit-ws-309-9.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x",
                  "product_id": "libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-309-9.1.x86_64",
                "product": {
                  "name": "cockpit-309-9.1.x86_64",
                  "product_id": "cockpit-309-9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-bridge-309-9.1.x86_64",
                "product": {
                  "name": "cockpit-bridge-309-9.1.x86_64",
                  "product_id": "cockpit-bridge-309-9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ws-309-9.1.x86_64",
                "product": {
                  "name": "cockpit-ws-309-9.1.x86_64",
                  "product_id": "cockpit-ws-309-9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64",
                  "product_id": "libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-309-9.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-309-9.1.aarch64"
        },
        "product_reference": "cockpit-309-9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-309-9.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-309-9.1.s390x"
        },
        "product_reference": "cockpit-309-9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-309-9.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-309-9.1.x86_64"
        },
        "product_reference": "cockpit-309-9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-bridge-309-9.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.aarch64"
        },
        "product_reference": "cockpit-bridge-309-9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-bridge-309-9.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.s390x"
        },
        "product_reference": "cockpit-bridge-309-9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-bridge-309-9.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.x86_64"
        },
        "product_reference": "cockpit-bridge-309-9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-networkmanager-309-9.1.noarch as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-networkmanager-309-9.1.noarch"
        },
        "product_reference": "cockpit-networkmanager-309-9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-selinux-309-9.1.noarch as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-selinux-309-9.1.noarch"
        },
        "product_reference": "cockpit-selinux-309-9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-storaged-309-9.1.noarch as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-storaged-309-9.1.noarch"
        },
        "product_reference": "cockpit-storaged-309-9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-system-309-9.1.noarch as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-system-309-9.1.noarch"
        },
        "product_reference": "cockpit-system-309-9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ws-309-9.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.aarch64"
        },
        "product_reference": "cockpit-ws-309-9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ws-309-9.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.s390x"
        },
        "product_reference": "cockpit-ws-309-9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ws-309-9.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.x86_64"
        },
        "product_reference": "cockpit-ws-309-9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:cockpit-309-9.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-309-9.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-309-9.1.x86_64",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.x86_64",
          "SUSE Linux Micro 6.0:cockpit-networkmanager-309-9.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-selinux-309-9.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-storaged-309-9.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-system-309-9.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.x86_64",
          "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64",
          "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le",
          "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x",
          "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:cockpit-309-9.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-309-9.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-309-9.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-networkmanager-309-9.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-selinux-309-9.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-storaged-309-9.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-system-309-9.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.x86_64",
            "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:cockpit-309-9.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-309-9.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-309-9.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-9.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-networkmanager-309-9.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-selinux-309-9.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-storaged-309-9.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-system-309-9.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-ws-309-9.1.x86_64",
            "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:libnghttp2-14-1.52.0-slfo.1.1_2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-27T09:43:31Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issue:\n\n- CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-1247,SUSE-SLE-Micro-5.3-2026-1247,SUSE-SLE-Micro-5.4-2026-1247,SUSE-SLE-Micro-5.5-2026-1247,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1247,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1247,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1247,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1247,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1247,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1247,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1247,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1247,SUSE-SUSE-MicroOS-5.2-2026-1247",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1247-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:1247-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261247-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:1247-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045376.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-04-10T10:34:43Z",
      "generator": {
        "date": "2026-04-10T10:34:43Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:1247-1",
      "initial_release_date": "2026-04-10T10:34:43Z",
      "revision_history": [
        {
          "date": "2026-04-10T10:34:43Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
                  "product_id": "libnghttp2-14-1.40.0-150200.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150200.22.1.aarch64",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150200.22.1.aarch64",
                  "product_id": "libnghttp2-devel-1.40.0-150200.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
                  "product_id": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150200.22.1.aarch64",
                "product": {
                  "name": "nghttp2-1.40.0-150200.22.1.aarch64",
                  "product_id": "nghttp2-1.40.0-150200.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150200.22.1.aarch64",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150200.22.1.aarch64",
                  "product_id": "python3-nghttp2-1.40.0-150200.22.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-64bit-1.40.0-150200.22.1.aarch64_ilp32",
                "product": {
                  "name": "libnghttp2-14-64bit-1.40.0-150200.22.1.aarch64_ilp32",
                  "product_id": "libnghttp2-14-64bit-1.40.0-150200.22.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-64bit-1.40.0-150200.22.1.aarch64_ilp32",
                "product": {
                  "name": "libnghttp2_asio1-64bit-1.40.0-150200.22.1.aarch64_ilp32",
                  "product_id": "libnghttp2_asio1-64bit-1.40.0-150200.22.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150200.22.1.i586",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150200.22.1.i586",
                  "product_id": "libnghttp2-14-1.40.0-150200.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150200.22.1.i586",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150200.22.1.i586",
                  "product_id": "libnghttp2-devel-1.40.0-150200.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.i586",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.i586",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150200.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150200.22.1.i586",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150200.22.1.i586",
                  "product_id": "libnghttp2_asio1-1.40.0-150200.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150200.22.1.i586",
                "product": {
                  "name": "nghttp2-1.40.0-150200.22.1.i586",
                  "product_id": "nghttp2-1.40.0-150200.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150200.22.1.i586",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150200.22.1.i586",
                  "product_id": "python3-nghttp2-1.40.0-150200.22.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150200.22.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150200.22.1.ppc64le",
                  "product_id": "libnghttp2-14-1.40.0-150200.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
                  "product_id": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
                  "product_id": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150200.22.1.ppc64le",
                "product": {
                  "name": "nghttp2-1.40.0-150200.22.1.ppc64le",
                  "product_id": "nghttp2-1.40.0-150200.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150200.22.1.ppc64le",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150200.22.1.ppc64le",
                  "product_id": "python3-nghttp2-1.40.0-150200.22.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150200.22.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150200.22.1.s390x",
                  "product_id": "libnghttp2-14-1.40.0-150200.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150200.22.1.s390x",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150200.22.1.s390x",
                  "product_id": "libnghttp2-devel-1.40.0-150200.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150200.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150200.22.1.s390x",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150200.22.1.s390x",
                  "product_id": "libnghttp2_asio1-1.40.0-150200.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150200.22.1.s390x",
                "product": {
                  "name": "nghttp2-1.40.0-150200.22.1.s390x",
                  "product_id": "nghttp2-1.40.0-150200.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150200.22.1.s390x",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150200.22.1.s390x",
                  "product_id": "python3-nghttp2-1.40.0-150200.22.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
                  "product_id": "libnghttp2-14-1.40.0-150200.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
                  "product_id": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
                  "product_id": "libnghttp2-devel-1.40.0-150200.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
                  "product_id": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-32bit-1.40.0-150200.22.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio1-32bit-1.40.0-150200.22.1.x86_64",
                  "product_id": "libnghttp2_asio1-32bit-1.40.0-150200.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150200.22.1.x86_64",
                "product": {
                  "name": "nghttp2-1.40.0-150200.22.1.x86_64",
                  "product_id": "nghttp2-1.40.0-150200.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150200.22.1.x86_64",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150200.22.1.x86_64",
                  "product_id": "python3-nghttp2-1.40.0-150200.22.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.3",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.3",
                  "product_id": "SUSE Linux Enterprise Micro 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.4",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.4",
                  "product_id": "SUSE Linux Enterprise Micro 5.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.5",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.5",
                  "product_id": "SUSE Linux Enterprise Micro 5.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.2",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.2",
                  "product_id": "SUSE Linux Enterprise Micro 5.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-microos:5.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-devel-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-devel-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150200.22.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150200.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.s390x",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:libnghttp2_asio1-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-14-32bit-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio-devel-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio-devel-1.40.0-150200.22.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio1-1.40.0-150200.22.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:libnghttp2_asio1-1.40.0-150200.22.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-10T10:34:43Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issues:\n\n- CVE-2026-27135: Assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-1074,SUSE-SLE-Module-Basesystem-15-SP7-2026-1074",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1074-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:1074-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261074-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:1074-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024959.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-03-26T12:39:53Z",
      "generator": {
        "date": "2026-03-26T12:39:53Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:1074-1",
      "initial_release_date": "2026-03-26T12:39:53Z",
      "revision_history": [
        {
          "date": "2026-03-26T12:39:53Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-150700.3.3.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.64.0-150700.3.3.1.aarch64",
                  "product_id": "libnghttp2-14-1.64.0-150700.3.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-150700.3.3.1.aarch64",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-150700.3.3.1.aarch64",
                  "product_id": "libnghttp2-devel-1.64.0-150700.3.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-150700.3.3.1.aarch64",
                "product": {
                  "name": "nghttp2-1.64.0-150700.3.3.1.aarch64",
                  "product_id": "nghttp2-1.64.0-150700.3.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-64bit-1.64.0-150700.3.3.1.aarch64_ilp32",
                "product": {
                  "name": "libnghttp2-14-64bit-1.64.0-150700.3.3.1.aarch64_ilp32",
                  "product_id": "libnghttp2-14-64bit-1.64.0-150700.3.3.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-150700.3.3.1.i586",
                "product": {
                  "name": "libnghttp2-14-1.64.0-150700.3.3.1.i586",
                  "product_id": "libnghttp2-14-1.64.0-150700.3.3.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-150700.3.3.1.i586",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-150700.3.3.1.i586",
                  "product_id": "libnghttp2-devel-1.64.0-150700.3.3.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-150700.3.3.1.i586",
                "product": {
                  "name": "nghttp2-1.64.0-150700.3.3.1.i586",
                  "product_id": "nghttp2-1.64.0-150700.3.3.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-150700.3.3.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.64.0-150700.3.3.1.ppc64le",
                  "product_id": "libnghttp2-14-1.64.0-150700.3.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le",
                  "product_id": "libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-150700.3.3.1.ppc64le",
                "product": {
                  "name": "nghttp2-1.64.0-150700.3.3.1.ppc64le",
                  "product_id": "nghttp2-1.64.0-150700.3.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-150700.3.3.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.64.0-150700.3.3.1.s390x",
                  "product_id": "libnghttp2-14-1.64.0-150700.3.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-150700.3.3.1.s390x",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-150700.3.3.1.s390x",
                  "product_id": "libnghttp2-devel-1.64.0-150700.3.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-150700.3.3.1.s390x",
                "product": {
                  "name": "nghttp2-1.64.0-150700.3.3.1.s390x",
                  "product_id": "nghttp2-1.64.0-150700.3.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-150700.3.3.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.64.0-150700.3.3.1.x86_64",
                  "product_id": "libnghttp2-14-1.64.0-150700.3.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64",
                  "product_id": "libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-150700.3.3.1.x86_64",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-150700.3.3.1.x86_64",
                  "product_id": "libnghttp2-devel-1.64.0-150700.3.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-150700.3.3.1.x86_64",
                "product": {
                  "name": "nghttp2-1.64.0-150700.3.3.1.x86_64",
                  "product_id": "nghttp2-1.64.0-150700.3.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-150700.3.3.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.64.0-150700.3.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-150700.3.3.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.64.0-150700.3.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-150700.3.3.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.64.0-150700.3.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-150700.3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.64.0-150700.3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-150700.3.3.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.64.0-150700.3.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-150700.3.3.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.64.0-150700.3.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-150700.3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.64.0-150700.3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-1.64.0-150700.3.3.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-14-32bit-1.64.0-150700.3.3.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2-devel-1.64.0-150700.3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-26T12:39:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issue:\n\n- CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-644",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20870-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20870-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620870-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20870-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024971.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-03-26T09:10:44Z",
      "generator": {
        "date": "2026-03-26T09:10:44Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20870-1",
      "initial_release_date": "2026-03-26T09:10:44Z",
      "revision_history": [
        {
          "date": "2026-03-26T09:10:44Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.52.0-6.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.52.0-6.1.aarch64",
                  "product_id": "libnghttp2-14-1.52.0-6.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.52.0-6.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.52.0-6.1.s390x",
                  "product_id": "libnghttp2-14-1.52.0-6.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.52.0-6.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.52.0-6.1.x86_64",
                  "product_id": "libnghttp2-14-1.52.0-6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.52.0-6.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.52.0-6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.52.0-6.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.52.0-6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.52.0-6.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.52.0-6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.aarch64",
          "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.s390x",
          "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.aarch64",
            "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.s390x",
            "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.aarch64",
            "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.s390x",
            "SUSE Linux Micro 6.0:libnghttp2-14-1.52.0-6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-26T09:10:44Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issue:\n\n- CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-432",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20925-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20925-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620925-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20925-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045227.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-03-24T12:31:51Z",
      "generator": {
        "date": "2026-03-24T12:31:51Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20925-1",
      "initial_release_date": "2026-03-24T12:31:51Z",
      "revision_history": [
        {
          "date": "2026-03-24T12:31:51Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-160000.3.1.aarch64",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-160000.3.1.aarch64",
                  "product_id": "libnghttp2-devel-1.64.0-160000.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-160000.3.1.aarch64",
                "product": {
                  "name": "nghttp2-1.64.0-160000.3.1.aarch64",
                  "product_id": "nghttp2-1.64.0-160000.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
                  "product_id": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-160000.3.1.ppc64le",
                "product": {
                  "name": "nghttp2-1.64.0-160000.3.1.ppc64le",
                  "product_id": "nghttp2-1.64.0-160000.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.s390x",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-160000.3.1.s390x",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-160000.3.1.s390x",
                  "product_id": "libnghttp2-devel-1.64.0-160000.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-160000.3.1.s390x",
                "product": {
                  "name": "nghttp2-1.64.0-160000.3.1.s390x",
                  "product_id": "nghttp2-1.64.0-160000.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
                  "product_id": "libnghttp2-14-1.64.0-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.64.0-160000.3.1.x86_64",
                "product": {
                  "name": "libnghttp2-devel-1.64.0-160000.3.1.x86_64",
                  "product_id": "libnghttp2-devel-1.64.0-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.64.0-160000.3.1.x86_64",
                "product": {
                  "name": "nghttp2-1.64.0-160000.3.1.x86_64",
                  "product_id": "nghttp2-1.64.0-160000.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.64.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.64.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.aarch64"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.ppc64le"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.s390x"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.64.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
        },
        "product_reference": "nghttp2-1.64.0-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
          "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.s390x",
          "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server 16.0:nghttp2-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-14-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:libnghttp2-devel-1.64.0-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nghttp2-1.64.0-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T12:31:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issues:\n\n- CVE-2026-27135: Assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-1056,SUSE-SLE-SERVER-12-SP5-LTSS-2026-1056,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1056",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1056-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:1056-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261056-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:1056-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024951.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-03-26T08:57:39Z",
      "generator": {
        "date": "2026-03-26T08:57:39Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:1056-1",
      "initial_release_date": "2026-03-26T08:57:39Z",
      "revision_history": [
        {
          "date": "2026-03-26T08:57:39Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.39.2-3.23.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.39.2-3.23.1.aarch64",
                  "product_id": "libnghttp2-14-1.39.2-3.23.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.39.2-3.23.1.aarch64",
                "product": {
                  "name": "libnghttp2-devel-1.39.2-3.23.1.aarch64",
                  "product_id": "libnghttp2-devel-1.39.2-3.23.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.39.2-3.23.1.aarch64",
                "product": {
                  "name": "libnghttp2_asio-devel-1.39.2-3.23.1.aarch64",
                  "product_id": "libnghttp2_asio-devel-1.39.2-3.23.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.39.2-3.23.1.aarch64",
                "product": {
                  "name": "libnghttp2_asio1-1.39.2-3.23.1.aarch64",
                  "product_id": "libnghttp2_asio1-1.39.2-3.23.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.39.2-3.23.1.aarch64",
                "product": {
                  "name": "nghttp2-1.39.2-3.23.1.aarch64",
                  "product_id": "nghttp2-1.39.2-3.23.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.39.2-3.23.1.aarch64",
                "product": {
                  "name": "python3-nghttp2-1.39.2-3.23.1.aarch64",
                  "product_id": "python3-nghttp2-1.39.2-3.23.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-64bit-1.39.2-3.23.1.aarch64_ilp32",
                "product": {
                  "name": "libnghttp2-14-64bit-1.39.2-3.23.1.aarch64_ilp32",
                  "product_id": "libnghttp2-14-64bit-1.39.2-3.23.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-64bit-1.39.2-3.23.1.aarch64_ilp32",
                "product": {
                  "name": "libnghttp2_asio1-64bit-1.39.2-3.23.1.aarch64_ilp32",
                  "product_id": "libnghttp2_asio1-64bit-1.39.2-3.23.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.39.2-3.23.1.i586",
                "product": {
                  "name": "libnghttp2-14-1.39.2-3.23.1.i586",
                  "product_id": "libnghttp2-14-1.39.2-3.23.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.39.2-3.23.1.i586",
                "product": {
                  "name": "libnghttp2-devel-1.39.2-3.23.1.i586",
                  "product_id": "libnghttp2-devel-1.39.2-3.23.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.39.2-3.23.1.i586",
                "product": {
                  "name": "libnghttp2_asio-devel-1.39.2-3.23.1.i586",
                  "product_id": "libnghttp2_asio-devel-1.39.2-3.23.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.39.2-3.23.1.i586",
                "product": {
                  "name": "libnghttp2_asio1-1.39.2-3.23.1.i586",
                  "product_id": "libnghttp2_asio1-1.39.2-3.23.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.39.2-3.23.1.i586",
                "product": {
                  "name": "nghttp2-1.39.2-3.23.1.i586",
                  "product_id": "nghttp2-1.39.2-3.23.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.39.2-3.23.1.i586",
                "product": {
                  "name": "python3-nghttp2-1.39.2-3.23.1.i586",
                  "product_id": "python3-nghttp2-1.39.2-3.23.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.39.2-3.23.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.39.2-3.23.1.ppc64le",
                  "product_id": "libnghttp2-14-1.39.2-3.23.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.39.2-3.23.1.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-1.39.2-3.23.1.ppc64le",
                  "product_id": "libnghttp2-devel-1.39.2-3.23.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.39.2-3.23.1.ppc64le",
                "product": {
                  "name": "libnghttp2_asio-devel-1.39.2-3.23.1.ppc64le",
                  "product_id": "libnghttp2_asio-devel-1.39.2-3.23.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.39.2-3.23.1.ppc64le",
                "product": {
                  "name": "libnghttp2_asio1-1.39.2-3.23.1.ppc64le",
                  "product_id": "libnghttp2_asio1-1.39.2-3.23.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.39.2-3.23.1.ppc64le",
                "product": {
                  "name": "nghttp2-1.39.2-3.23.1.ppc64le",
                  "product_id": "nghttp2-1.39.2-3.23.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.39.2-3.23.1.ppc64le",
                "product": {
                  "name": "python3-nghttp2-1.39.2-3.23.1.ppc64le",
                  "product_id": "python3-nghttp2-1.39.2-3.23.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.39.2-3.23.1.s390",
                "product": {
                  "name": "libnghttp2-14-1.39.2-3.23.1.s390",
                  "product_id": "libnghttp2-14-1.39.2-3.23.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.39.2-3.23.1.s390",
                "product": {
                  "name": "libnghttp2-devel-1.39.2-3.23.1.s390",
                  "product_id": "libnghttp2-devel-1.39.2-3.23.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.39.2-3.23.1.s390",
                "product": {
                  "name": "libnghttp2_asio-devel-1.39.2-3.23.1.s390",
                  "product_id": "libnghttp2_asio-devel-1.39.2-3.23.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.39.2-3.23.1.s390",
                "product": {
                  "name": "libnghttp2_asio1-1.39.2-3.23.1.s390",
                  "product_id": "libnghttp2_asio1-1.39.2-3.23.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.39.2-3.23.1.s390",
                "product": {
                  "name": "nghttp2-1.39.2-3.23.1.s390",
                  "product_id": "nghttp2-1.39.2-3.23.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.39.2-3.23.1.s390",
                "product": {
                  "name": "python3-nghttp2-1.39.2-3.23.1.s390",
                  "product_id": "python3-nghttp2-1.39.2-3.23.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.39.2-3.23.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.39.2-3.23.1.s390x",
                  "product_id": "libnghttp2-14-1.39.2-3.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.39.2-3.23.1.s390x",
                "product": {
                  "name": "libnghttp2-14-32bit-1.39.2-3.23.1.s390x",
                  "product_id": "libnghttp2-14-32bit-1.39.2-3.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.39.2-3.23.1.s390x",
                "product": {
                  "name": "libnghttp2-devel-1.39.2-3.23.1.s390x",
                  "product_id": "libnghttp2-devel-1.39.2-3.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.39.2-3.23.1.s390x",
                "product": {
                  "name": "libnghttp2_asio-devel-1.39.2-3.23.1.s390x",
                  "product_id": "libnghttp2_asio-devel-1.39.2-3.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.39.2-3.23.1.s390x",
                "product": {
                  "name": "libnghttp2_asio1-1.39.2-3.23.1.s390x",
                  "product_id": "libnghttp2_asio1-1.39.2-3.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-32bit-1.39.2-3.23.1.s390x",
                "product": {
                  "name": "libnghttp2_asio1-32bit-1.39.2-3.23.1.s390x",
                  "product_id": "libnghttp2_asio1-32bit-1.39.2-3.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.39.2-3.23.1.s390x",
                "product": {
                  "name": "nghttp2-1.39.2-3.23.1.s390x",
                  "product_id": "nghttp2-1.39.2-3.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.39.2-3.23.1.s390x",
                "product": {
                  "name": "python3-nghttp2-1.39.2-3.23.1.s390x",
                  "product_id": "python3-nghttp2-1.39.2-3.23.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.39.2-3.23.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.39.2-3.23.1.x86_64",
                  "product_id": "libnghttp2-14-1.39.2-3.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
                  "product_id": "libnghttp2-14-32bit-1.39.2-3.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.39.2-3.23.1.x86_64",
                "product": {
                  "name": "libnghttp2-devel-1.39.2-3.23.1.x86_64",
                  "product_id": "libnghttp2-devel-1.39.2-3.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.39.2-3.23.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio-devel-1.39.2-3.23.1.x86_64",
                  "product_id": "libnghttp2_asio-devel-1.39.2-3.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.39.2-3.23.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio1-1.39.2-3.23.1.x86_64",
                  "product_id": "libnghttp2_asio1-1.39.2-3.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-32bit-1.39.2-3.23.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio1-32bit-1.39.2-3.23.1.x86_64",
                  "product_id": "libnghttp2_asio1-32bit-1.39.2-3.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.39.2-3.23.1.x86_64",
                "product": {
                  "name": "nghttp2-1.39.2-3.23.1.x86_64",
                  "product_id": "nghttp2-1.39.2-3.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.39.2-3.23.1.x86_64",
                "product": {
                  "name": "python3-nghttp2-1.39.2-3.23.1.x86_64",
                  "product_id": "python3-nghttp2-1.39.2-3.23.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.39.2-3.23.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.39.2-3.23.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.39.2-3.23.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.39.2-3.23.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.39.2-3.23.1.s390x as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.39.2-3.23.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.39.2-3.23.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.39.2-3.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.39.2-3.23.1.s390x as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-32bit-1.39.2-3.23.1.s390x"
        },
        "product_reference": "libnghttp2-14-32bit-1.39.2-3.23.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.39.2-3.23.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-32bit-1.39.2-3.23.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.39.2-3.23.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.39.2-3.23.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.39.2-3.23.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.39.2-3.23.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.39.2-3.23.1.s390x as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.39.2-3.23.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.39.2-3.23.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.39.2-3.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.39.2-3.23.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-14-1.39.2-3.23.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.39.2-3.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.39.2-3.23.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-14-32bit-1.39.2-3.23.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.39.2-3.23.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-devel-1.39.2-3.23.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.39.2-3.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-32bit-1.39.2-3.23.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-14-1.39.2-3.23.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-devel-1.39.2-3.23.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-32bit-1.39.2-3.23.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-14-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-devel-1.39.2-3.23.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-32bit-1.39.2-3.23.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:libnghttp2-devel-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-14-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-14-32bit-1.39.2-3.23.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libnghttp2-devel-1.39.2-3.23.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-26T08:57:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nghttp2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nghttp2 fixes the following issue:\n\n- CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-1350,SUSE-SLE-Module-Basesystem-15-SP7-2026-1350,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1350,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1350,openSUSE-SLE-15.6-2026-1350",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1350-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:1350-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261350-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:1350-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045565.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259845",
        "url": "https://bugzilla.suse.com/1259845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27135 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27135/"
      }
    ],
    "title": "Security update for nghttp2",
    "tracking": {
      "current_release_date": "2026-04-15T13:36:21Z",
      "generator": {
        "date": "2026-04-15T13:36:21Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:1350-1",
      "initial_release_date": "2026-04-15T13:36:21Z",
      "revision_history": [
        {
          "date": "2026-04-15T13:36:21Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
                  "product_id": "libnghttp2-14-1.40.0-150600.25.5.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
                  "product_id": "libnghttp2-devel-1.40.0-150600.25.5.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
                  "product_id": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150600.25.5.1.aarch64",
                "product": {
                  "name": "nghttp2-1.40.0-150600.25.5.1.aarch64",
                  "product_id": "nghttp2-1.40.0-150600.25.5.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150600.25.5.1.aarch64",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150600.25.5.1.aarch64",
                  "product_id": "python3-nghttp2-1.40.0-150600.25.5.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-64bit-1.40.0-150600.25.5.1.aarch64_ilp32",
                "product": {
                  "name": "libnghttp2-14-64bit-1.40.0-150600.25.5.1.aarch64_ilp32",
                  "product_id": "libnghttp2-14-64bit-1.40.0-150600.25.5.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-64bit-1.40.0-150600.25.5.1.aarch64_ilp32",
                "product": {
                  "name": "libnghttp2_asio1-64bit-1.40.0-150600.25.5.1.aarch64_ilp32",
                  "product_id": "libnghttp2_asio1-64bit-1.40.0-150600.25.5.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150600.25.5.1.i586",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150600.25.5.1.i586",
                  "product_id": "libnghttp2-14-1.40.0-150600.25.5.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150600.25.5.1.i586",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150600.25.5.1.i586",
                  "product_id": "libnghttp2-devel-1.40.0-150600.25.5.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.i586",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.i586",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.i586",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.i586",
                  "product_id": "libnghttp2_asio1-1.40.0-150600.25.5.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150600.25.5.1.i586",
                "product": {
                  "name": "nghttp2-1.40.0-150600.25.5.1.i586",
                  "product_id": "nghttp2-1.40.0-150600.25.5.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150600.25.5.1.i586",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150600.25.5.1.i586",
                  "product_id": "python3-nghttp2-1.40.0-150600.25.5.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
                  "product_id": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
                  "product_id": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
                  "product_id": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150600.25.5.1.ppc64le",
                "product": {
                  "name": "nghttp2-1.40.0-150600.25.5.1.ppc64le",
                  "product_id": "nghttp2-1.40.0-150600.25.5.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150600.25.5.1.ppc64le",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150600.25.5.1.ppc64le",
                  "product_id": "python3-nghttp2-1.40.0-150600.25.5.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150600.25.5.1.s390x",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150600.25.5.1.s390x",
                  "product_id": "libnghttp2-14-1.40.0-150600.25.5.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
                  "product_id": "libnghttp2-devel-1.40.0-150600.25.5.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
                  "product_id": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150600.25.5.1.s390x",
                "product": {
                  "name": "nghttp2-1.40.0-150600.25.5.1.s390x",
                  "product_id": "nghttp2-1.40.0-150600.25.5.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150600.25.5.1.s390x",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150600.25.5.1.s390x",
                  "product_id": "python3-nghttp2-1.40.0-150600.25.5.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
                  "product_id": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
                "product": {
                  "name": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
                  "product_id": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
                "product": {
                  "name": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
                  "product_id": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
                  "product_id": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
                  "product_id": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64",
                "product": {
                  "name": "libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64",
                  "product_id": "libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-1.40.0-150600.25.5.1.x86_64",
                "product": {
                  "name": "nghttp2-1.40.0-150600.25.5.1.x86_64",
                  "product_id": "nghttp2-1.40.0-150600.25.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-nghttp2-1.40.0-150600.25.5.1.x86_64",
                "product": {
                  "name": "python3-nghttp2-1.40.0-150600.25.5.1.x86_64",
                  "product_id": "python3-nghttp2-1.40.0-150600.25.5.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.40.0-150600.25.5.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "nghttp2-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.40.0-150600.25.5.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "nghttp2-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.40.0-150600.25.5.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "nghttp2-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-1.40.0-150600.25.5.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "nghttp2-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-nghttp2-1.40.0-150600.25.5.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.aarch64"
        },
        "product_reference": "python3-nghttp2-1.40.0-150600.25.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-nghttp2-1.40.0-150600.25.5.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.ppc64le"
        },
        "product_reference": "python3-nghttp2-1.40.0-150600.25.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-nghttp2-1.40.0-150600.25.5.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.s390x"
        },
        "product_reference": "python3-nghttp2-1.40.0-150600.25.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-nghttp2-1.40.0-150600.25.5.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.x86_64"
        },
        "product_reference": "python3-nghttp2-1.40.0-150600.25.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27135"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
          "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
          "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
          "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.s390x",
          "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
          "openSUSE Leap 15.6:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
          "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
          "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
          "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
          "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
          "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
          "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
          "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
          "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
          "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
          "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
          "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
          "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
          "openSUSE Leap 15.6:libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64",
          "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.aarch64",
          "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.ppc64le",
          "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.s390x",
          "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.x86_64",
          "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.aarch64",
          "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.ppc64le",
          "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.s390x",
          "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27135",
          "url": "https://www.suse.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259835 for CVE-2026-27135",
          "url": "https://bugzilla.suse.com/1259835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:libnghttp2-14-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2-14-32bit-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:libnghttp2-devel-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:libnghttp2_asio-devel-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:libnghttp2_asio1-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:libnghttp2_asio1-32bit-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:nghttp2-1.40.0-150600.25.5.1.x86_64",
            "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.aarch64",
            "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.ppc64le",
            "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.s390x",
            "openSUSE Leap 15.6:python3-nghttp2-1.40.0-150600.25.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-15T13:36:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27135"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:20 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8339",
        "url": "https://access.redhat.com/errata/RHSA-2026:8339"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2441268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
      },
      {
        "category": "external",
        "summary": "2442922",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2453151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
      },
      {
        "category": "external",
        "summary": "RHEL-154018",
        "url": "https://issues.redhat.com/browse/RHEL-154018"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8339.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:20 security update",
    "tracking": {
      "current_release_date": "2026-04-28T20:08:37+00:00",
      "generator": {
        "date": "2026-04-28T20:08:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:8339",
      "initial_release_date": "2026-04-15T19:16:52+00:00",
      "revision_history": [
        {
          "date": "2026-04-15T19:16:52+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-15T19:16:52+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T20:08:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=src\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src (nodejs:20)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel8.10.0%2B23521%2B490ebfde?arch=src\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src (nodejs:20)",
                  "product_id": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel8.10.0%2B24197%2B1602b452?arch=src\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch (nodejs:20)",
                  "product_id": "nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch (nodejs:20)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel8.10.0%2B23521%2B490ebfde?arch=noarch\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch (nodejs:20)",
                  "product_id": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel8.10.0%2B24197%2B1602b452?arch=noarch\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch (nodejs:20)",
                  "product_id": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-6.module%2Bel8.10.0%2B24197%2B1602b452?arch=noarch\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20)",
                  "product_id": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20)",
                  "product_id": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                "product": {
                  "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20)",
                  "product_id": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.8.2-1.20.20.2.1.module%2Bel8.10.0%2B24197%2B1602b452?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20)",
                  "product_id": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20)",
                  "product_id": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                "product": {
                  "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20)",
                  "product_id": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.8.2-1.20.20.2.1.module%2Bel8.10.0%2B24197%2B1602b452?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20)",
                  "product_id": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20)",
                  "product_id": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                "product": {
                  "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x (nodejs:20)",
                  "product_id": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.8.2-1.20.20.2.1.module%2Bel8.10.0%2B24197%2B1602b452?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20)",
                  "product_id": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20)",
                  "product_id": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@20.20.2-1.module%2Bel8.10.0%2B24197%2B1602b452?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                "product": {
                  "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20)",
                  "product_id": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.8.2-1.20.20.2.1.module%2Bel8.10.0%2B24197%2B1602b452?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:8100020260414073138:489197e6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20"
        },
        "product_reference": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20"
        },
        "product_reference": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20"
        },
        "product_reference": "nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20"
        },
        "product_reference": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20"
        },
        "product_reference": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20"
        },
        "product_reference": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20"
        },
        "product_reference": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20"
        },
        "product_reference": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20"
        },
        "product_reference": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        },
        "product_reference": "npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-21710",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:21.196629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T19:16:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8339"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T19:16:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8339"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T19:16:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8339"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27904",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-26T02:01:23.004531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442922"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442922",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "release_date": "2026-02-26T01:07:42.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T19:16:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8339"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:20.20.2-1.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:20.20.2-1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+23521+490ebfde.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24197+1602b452.src::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24197+1602b452.noarch::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.s390x::nodejs:20",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nghttp2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8868",
        "url": "https://access.redhat.com/errata/RHSA-2026:8868"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8868.json"
      }
    ],
    "title": "Red Hat Security Advisory: nghttp2 security update",
    "tracking": {
      "current_release_date": "2026-04-28T18:40:40+00:00",
      "generator": {
        "date": "2026-04-28T18:40:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:8868",
      "initial_release_date": "2026-04-20T02:56:54+00:00",
      "revision_history": [
        {
          "date": "2026-04-20T02:56:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-20T02:56:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T18:40:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                  "product_id": "AppStream-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
                  "product_id": "BaseOS-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
                  "product_id": "CRB-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
                "product": {
                  "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
                  "product_id": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.64.0-2.el10_0.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
                  "product_id": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.64.0-2.el10_0.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
                  "product_id": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.64.0-2.el10_0.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
                  "product_id": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.64.0-2.el10_0.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
                "product": {
                  "name": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
                  "product_id": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.64.0-2.el10_0.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.64.0-2.el10_0.1.aarch64",
                "product": {
                  "name": "nghttp2-0:1.64.0-2.el10_0.1.aarch64",
                  "product_id": "nghttp2-0:1.64.0-2.el10_0.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.64.0-2.el10_0.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_id": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.64.0-2.el10_0.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
                "product": {
                  "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_id": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.64.0-2.el10_0.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_id": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.64.0-2.el10_0.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_id": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.64.0-2.el10_0.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
                "product": {
                  "name": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_id": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.64.0-2.el10_0.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
                "product": {
                  "name": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_id": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.64.0-2.el10_0.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
                "product": {
                  "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
                  "product_id": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.64.0-2.el10_0.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
                "product": {
                  "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
                  "product_id": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.64.0-2.el10_0.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
                  "product_id": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.64.0-2.el10_0.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
                  "product_id": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.64.0-2.el10_0.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.64.0-2.el10_0.1.s390x",
                "product": {
                  "name": "libnghttp2-0:1.64.0-2.el10_0.1.s390x",
                  "product_id": "libnghttp2-0:1.64.0-2.el10_0.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.64.0-2.el10_0.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.64.0-2.el10_0.1.s390x",
                "product": {
                  "name": "nghttp2-0:1.64.0-2.el10_0.1.s390x",
                  "product_id": "nghttp2-0:1.64.0-2.el10_0.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.64.0-2.el10_0.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
                "product": {
                  "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
                  "product_id": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.64.0-2.el10_0.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
                  "product_id": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.64.0-2.el10_0.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
                  "product_id": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.64.0-2.el10_0.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
                  "product_id": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.64.0-2.el10_0.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
                "product": {
                  "name": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
                  "product_id": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.64.0-2.el10_0.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.64.0-2.el10_0.1.x86_64",
                "product": {
                  "name": "nghttp2-0:1.64.0-2.el10_0.1.x86_64",
                  "product_id": "nghttp2-0:1.64.0-2.el10_0.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.64.0-2.el10_0.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-0:1.64.0-2.el10_0.1.src",
                "product": {
                  "name": "nghttp2-0:1.64.0-2.el10_0.1.src",
                  "product_id": "nghttp2-0:1.64.0-2.el10_0.1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.64.0-2.el10_0.1?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.src",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.src",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.src as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.src",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
          "product_id": "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
        "relates_to_product_reference": "CRB-10.0.Z.E2S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
          "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
          "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
          "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
          "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
          "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
          "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
          "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
          "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
          "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
          "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
          "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
          "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
          "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
          "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
          "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
          "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
          "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
          "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
          "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
          "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
          "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
          "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
          "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
          "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
          "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
          "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
          "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
          "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
          "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
          "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
          "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
          "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
          "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
          "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
          "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
          "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
          "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
          "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
          "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
          "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
          "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
          "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
          "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
          "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
          "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
          "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
          "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
          "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
          "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
          "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
          "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
          "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
          "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
          "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
          "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
          "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
          "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
          "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
          "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
          "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
          "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
          "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
          "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
          "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
          "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
          "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
          "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
          "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
          "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
          "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
          "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
          "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
          "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
          "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-20T02:56:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8868"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
            "AppStream-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
            "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
            "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
            "AppStream-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
            "BaseOS-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
            "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
            "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
            "BaseOS-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:libnghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:libnghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:libnghttp2-devel-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.src",
            "CRB-10.0.Z.E2S:nghttp2-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:nghttp2-debuginfo-0:1.64.0-2.el10_0.1.x86_64",
            "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.aarch64",
            "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.ppc64le",
            "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.s390x",
            "CRB-10.0.Z.E2S:nghttp2-debugsource-0:1.64.0-2.el10_0.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:20 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:9874",
        "url": "https://access.redhat.com/errata/RHSA-2026:9874"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2441268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
      },
      {
        "category": "external",
        "summary": "2442922",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2453151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9874.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:20 security update",
    "tracking": {
      "current_release_date": "2026-04-28T20:08:41+00:00",
      "generator": {
        "date": "2026-04-28T20:08:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:9874",
      "initial_release_date": "2026-04-22T21:54:54+00:00",
      "revision_history": [
        {
          "date": "2026-04-22T21:54:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-22T21:54:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T20:08:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                  "product_id": "AppStream-9.6.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=src\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src (nodejs:20)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel9.6.0%2B23146%2Bbe9976bd?arch=src\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src (nodejs:20)",
                  "product_id": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.6.0%2B23146%2Bbe9976bd?arch=src\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch (nodejs:20)",
                  "product_id": "nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch (nodejs:20)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel9.6.0%2B23146%2Bbe9976bd?arch=noarch\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch (nodejs:20)",
                  "product_id": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-4.module%2Bel9.6.0%2B23146%2Bbe9976bd?arch=noarch\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch (nodejs:20)",
                  "product_id": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-4.module%2Bel9.6.0%2B23146%2Bbe9976bd?arch=noarch\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20)",
                  "product_id": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20)",
                  "product_id": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                "product": {
                  "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20)",
                  "product_id": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.8.2-1.20.20.2.2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20)",
                  "product_id": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20)",
                  "product_id": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                "product": {
                  "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20)",
                  "product_id": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.8.2-1.20.20.2.2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20)",
                  "product_id": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20)",
                  "product_id": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                "product": {
                  "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20)",
                  "product_id": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.8.2-1.20.20.2.2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20)",
                  "product_id": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20)",
                  "product_id": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20)",
                  "product_id": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@20.20.2-2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                "product": {
                  "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20)",
                  "product_id": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.8.2-1.20.20.2.2.module%2Bel9.6.0%2B24220%2Bc44c288d?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:20:9060020260422064119:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20"
        },
        "product_reference": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20"
        },
        "product_reference": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20"
        },
        "product_reference": "nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20"
        },
        "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20"
        },
        "product_reference": "nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20"
        },
        "product_reference": "nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20"
        },
        "product_reference": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20"
        },
        "product_reference": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20"
        },
        "product_reference": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        },
        "product_reference": "npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-21710",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:21.196629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-22T21:54:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:9874"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-22T21:54:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:9874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-22T21:54:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:9874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27904",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-26T02:01:23.004531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442922"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
          "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
          "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442922",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "release_date": "2026-02-26T01:07:42.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-22T21:54:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:9874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debuginfo-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-debugsource-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-devel-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-docs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-full-i18n-1:20.20.2-2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-nodemon-0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20",
            "AppStream-9.6.0.Z.EUS:nodejs-packaging-bundler-0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20",
            "AppStream-9.6.0.Z.EUS:npm-1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nghttp2 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8547",
        "url": "https://access.redhat.com/errata/RHSA-2026:8547"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8547.json"
      }
    ],
    "title": "Red Hat Security Advisory: nghttp2 security update",
    "tracking": {
      "current_release_date": "2026-04-28T18:40:36+00:00",
      "generator": {
        "date": "2026-04-28T18:40:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:8547",
      "initial_release_date": "2026-04-16T19:57:47+00:00",
      "revision_history": [
        {
          "date": "2026-04-16T19:57:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-16T19:57:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T18:40:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
                  "product_id": "BaseOS-9.4.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:9.4::baseos"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat CodeReady Linux Builder EUS (v.9.4)",
                "product": {
                  "name": "Red Hat CodeReady Linux Builder EUS (v.9.4)",
                  "product_id": "CRB-9.4.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.4::crb"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
                "product": {
                  "name": "libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
                  "product_id": "libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9_4.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
                  "product_id": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.43.0-5.el9_4.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
                  "product_id": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.43.0-5.el9_4.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
                  "product_id": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.43.0-5.el9_4.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
                "product": {
                  "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
                  "product_id": "libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.43.0-5.el9_4.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.43.0-5.el9_4.4.aarch64",
                "product": {
                  "name": "nghttp2-0:1.43.0-5.el9_4.4.aarch64",
                  "product_id": "nghttp2-0:1.43.0-5.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.43.0-5.el9_4.4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
                "product": {
                  "name": "libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_id": "libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9_4.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
                "product": {
                  "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_id": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.43.0-5.el9_4.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_id": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.43.0-5.el9_4.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_id": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.43.0-5.el9_4.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_id": "libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.43.0-5.el9_4.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
                "product": {
                  "name": "nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_id": "nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.43.0-5.el9_4.4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.43.0-5.el9_4.4.i686",
                "product": {
                  "name": "libnghttp2-0:1.43.0-5.el9_4.4.i686",
                  "product_id": "libnghttp2-0:1.43.0-5.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9_4.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
                "product": {
                  "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
                  "product_id": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.43.0-5.el9_4.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
                  "product_id": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.43.0-5.el9_4.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
                  "product_id": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.43.0-5.el9_4.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
                "product": {
                  "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
                  "product_id": "libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.43.0-5.el9_4.4?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
                "product": {
                  "name": "libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
                  "product_id": "libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9_4.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64",
                  "product_id": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.43.0-5.el9_4.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
                  "product_id": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.43.0-5.el9_4.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
                  "product_id": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.43.0-5.el9_4.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
                "product": {
                  "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
                  "product_id": "libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.43.0-5.el9_4.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.43.0-5.el9_4.4.x86_64",
                "product": {
                  "name": "nghttp2-0:1.43.0-5.el9_4.4.x86_64",
                  "product_id": "nghttp2-0:1.43.0-5.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.43.0-5.el9_4.4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.43.0-5.el9_4.4.s390x",
                "product": {
                  "name": "libnghttp2-0:1.43.0-5.el9_4.4.s390x",
                  "product_id": "libnghttp2-0:1.43.0-5.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9_4.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
                "product": {
                  "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
                  "product_id": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.43.0-5.el9_4.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
                  "product_id": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.43.0-5.el9_4.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
                  "product_id": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.43.0-5.el9_4.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
                "product": {
                  "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
                  "product_id": "libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.43.0-5.el9_4.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.43.0-5.el9_4.4.s390x",
                "product": {
                  "name": "nghttp2-0:1.43.0-5.el9_4.4.s390x",
                  "product_id": "nghttp2-0:1.43.0-5.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.43.0-5.el9_4.4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-0:1.43.0-5.el9_4.4.src",
                "product": {
                  "name": "nghttp2-0:1.43.0-5.el9_4.4.src",
                  "product_id": "nghttp2-0:1.43.0-5.el9_4.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.43.0-5.el9_4.4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.src"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.src",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)",
          "product_id": "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.src as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.src"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.src",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "nghttp2-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)",
          "product_id": "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64",
        "relates_to_product_reference": "CRB-9.4.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.i686",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.s390x",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
          "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
          "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.aarch64",
          "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
          "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.s390x",
          "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.src",
          "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.x86_64",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
          "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64",
          "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
          "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.i686",
          "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
          "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.s390x",
          "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
          "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
          "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
          "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
          "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
          "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
          "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
          "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
          "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
          "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
          "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
          "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.aarch64",
          "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
          "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.s390x",
          "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.src",
          "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.x86_64",
          "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
          "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
          "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
          "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
          "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
          "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
          "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
          "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
          "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
          "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T19:57:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.src",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.src",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8547"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.src",
            "BaseOS-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
            "BaseOS-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:libnghttp2-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:libnghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:libnghttp2-devel-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.src",
            "CRB-9.4.0.Z.EUS:nghttp2-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:nghttp2-debuginfo-0:1.43.0-5.el9_4.4.x86_64",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.aarch64",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.i686",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.ppc64le",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.s390x",
            "CRB-9.4.0.Z.EUS:nghttp2-debugsource-0:1.43.0-5.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nodejs22 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a platform built on Chrome\u0027s JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7310",
        "url": "https://access.redhat.com/errata/RHSA-2026:7310"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2441268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
      },
      {
        "category": "external",
        "summary": "2442922",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
      },
      {
        "category": "external",
        "summary": "2447142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
      },
      {
        "category": "external",
        "summary": "2447143",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
      },
      {
        "category": "external",
        "summary": "2447144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
      },
      {
        "category": "external",
        "summary": "2447145",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2453151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7310.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs22 security update",
    "tracking": {
      "current_release_date": "2026-04-28T20:08:32+00:00",
      "generator": {
        "date": "2026-04-28T20:08:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:7310",
      "initial_release_date": "2026-04-09T13:38:21+00:00",
      "revision_history": [
        {
          "date": "2026-04-09T13:38:21+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-09T13:38:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T20:08:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                  "product_id": "AppStream-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-2.el10_0.x86_64",
                "product": {
                  "name": "nodejs-1:22.22.2-2.el10_0.x86_64",
                  "product_id": "nodejs-1:22.22.2-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-2.el10_0.x86_64",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-2.el10_0.x86_64",
                  "product_id": "nodejs-devel-1:22.22.2-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
                  "product_id": "nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-2.el10_0.x86_64",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-2.el10_0.x86_64",
                  "product_id": "nodejs-libs-1:22.22.2-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64",
                  "product_id": "nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
                  "product_id": "nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-2.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-2.el10_0.aarch64",
                "product": {
                  "name": "nodejs-1:22.22.2-2.el10_0.aarch64",
                  "product_id": "nodejs-1:22.22.2-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-2.el10_0.aarch64",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-2.el10_0.aarch64",
                  "product_id": "nodejs-devel-1:22.22.2-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
                  "product_id": "nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-2.el10_0.aarch64",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-2.el10_0.aarch64",
                  "product_id": "nodejs-libs-1:22.22.2-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
                  "product_id": "nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
                  "product_id": "nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-2.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-1:22.22.2-2.el10_0.ppc64le",
                  "product_id": "nodejs-1:22.22.2-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
                  "product_id": "nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
                  "product_id": "nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
                  "product_id": "nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
                  "product_id": "nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                  "product_id": "nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-2.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-2.el10_0.s390x",
                "product": {
                  "name": "nodejs-1:22.22.2-2.el10_0.s390x",
                  "product_id": "nodejs-1:22.22.2-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-2.el10_0.s390x",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-2.el10_0.s390x",
                  "product_id": "nodejs-devel-1:22.22.2-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
                  "product_id": "nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-2.el10_0.s390x",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-2.el10_0.s390x",
                  "product_id": "nodejs-libs-1:22.22.2-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
                  "product_id": "nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
                  "product_id": "nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-2.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:22.22.2-2.el10_0.noarch",
                "product": {
                  "name": "nodejs-docs-1:22.22.2-2.el10_0.noarch",
                  "product_id": "nodejs-docs-1:22.22.2-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@22.22.2-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs22-1:22.22.2-2.el10_0.src",
                "product": {
                  "name": "nodejs22-1:22.22.2-2.el10_0.src",
                  "product_id": "nodejs22-1:22.22.2-2.el10_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22@22.22.2-2.el10_0?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64"
        },
        "product_reference": "nodejs-1:22.22.2-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le"
        },
        "product_reference": "nodejs-1:22.22.2-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x"
        },
        "product_reference": "nodejs-1:22.22.2-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64"
        },
        "product_reference": "nodejs-1:22.22.2-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64"
        },
        "product_reference": "nodejs-devel-1:22.22.2-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le"
        },
        "product_reference": "nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x"
        },
        "product_reference": "nodejs-devel-1:22.22.2-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64"
        },
        "product_reference": "nodejs-devel-1:22.22.2-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:22.22.2-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch"
        },
        "product_reference": "nodejs-docs-1:22.22.2-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64"
        },
        "product_reference": "nodejs-libs-1:22.22.2-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le"
        },
        "product_reference": "nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x"
        },
        "product_reference": "nodejs-libs-1:22.22.2-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64"
        },
        "product_reference": "nodejs-libs-1:22.22.2-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-1:22.22.2-2.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src"
        },
        "product_reference": "nodejs22-1:22.22.2-2.el10_0.src",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1525",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-12T21:01:33.639277+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447144"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., \"Content-Length\" and \"content-length\"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. A flaw in the undici Node.js HTTP/1.1 client allows for HTTP Request Smuggling or Denial of Service. This can occur in Red Hat products that use undici and process HTTP requests where user-controlled header names are not case-normalized, or headers are passed as flat arrays.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447144",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://cwe.mitre.org/data/definitions/444.html",
          "url": "https://cwe.mitre.org/data/definitions/444.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3556037",
          "url": "https://hackerone.com/reports/3556037"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6",
          "url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"
        }
      ],
      "release_date": "2026-03-12T19:56:55.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers"
    },
    {
      "cve": "CVE-2026-1526",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-12T21:01:25.538271+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447142"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a \"decompression bomb,\" during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447142",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3481206",
          "url": "https://hackerone.com/reports/3481206"
        }
      ],
      "release_date": "2026-03-12T20:08:05.950000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression"
    },
    {
      "cve": "CVE-2026-1528",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:36.954017+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447145"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici\u0027s ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via crafted WebSocket frame with large length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447145",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1528",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3537648",
          "url": "https://hackerone.com/reports/3537648"
        }
      ],
      "release_date": "2026-03-12T20:21:57.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via crafted WebSocket frame with large length"
    },
    {
      "cve": "CVE-2026-2229",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:29.187989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447143"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client\u0027s Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447143",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2229",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3487486",
          "url": "https://hackerone.com/reports/3487486"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/api/zlib.html#class-zlibinflateraw",
          "url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"
        }
      ],
      "release_date": "2026-03-12T20:27:05.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter"
    },
    {
      "cve": "CVE-2026-21710",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:21.196629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header"
    },
    {
      "cve": "CVE-2026-25547",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-02-04T22:01:11.784120+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436942"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion component. This denial of service (DoS) vulnerability allows a remote attacker to provide specially crafted input containing repeated numeric brace ranges. This input causes the library to attempt an unbounded expansion, consuming excessive CPU and memory resources. This can lead to a system crash, impacting the availability of the service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436942",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2",
          "url": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2"
        }
      ],
      "release_date": "2026-02-04T21:51:17.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27904",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-26T02:01:23.004531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442922"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442922",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "release_date": "2026-02-26T01:07:42.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:38:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7310"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.22.2-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.7-1.22.22.2.2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.22.2-2.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.22.2-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.22.2-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nodejs24 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a platform built on Chrome\u0027s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7675",
        "url": "https://access.redhat.com/errata/RHSA-2026:7675"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2431340",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431340"
      },
      {
        "category": "external",
        "summary": "2436942",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
      },
      {
        "category": "external",
        "summary": "2441268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
      },
      {
        "category": "external",
        "summary": "2447140",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447140"
      },
      {
        "category": "external",
        "summary": "2447141",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447141"
      },
      {
        "category": "external",
        "summary": "2447142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
      },
      {
        "category": "external",
        "summary": "2447143",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
      },
      {
        "category": "external",
        "summary": "2447144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
      },
      {
        "category": "external",
        "summary": "2447145",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2453037",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453037"
      },
      {
        "category": "external",
        "summary": "2453151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
      },
      {
        "category": "external",
        "summary": "2453152",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453152"
      },
      {
        "category": "external",
        "summary": "2453157",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453157"
      },
      {
        "category": "external",
        "summary": "2453158",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453158"
      },
      {
        "category": "external",
        "summary": "2453160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453160"
      },
      {
        "category": "external",
        "summary": "2453161",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453161"
      },
      {
        "category": "external",
        "summary": "2453162",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453162"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7675.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs24 security update",
    "tracking": {
      "current_release_date": "2026-04-28T20:08:34+00:00",
      "generator": {
        "date": "2026-04-28T20:08:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:7675",
      "initial_release_date": "2026-04-13T02:27:36+00:00",
      "revision_history": [
        {
          "date": "2026-04-13T02:27:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-13T02:27:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T20:08:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.1.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-1:24.14.1-2.el10_1.s390x",
                "product": {
                  "name": "nodejs24-1:24.14.1-2.el10_1.s390x",
                  "product_id": "nodejs24-1:24.14.1-2.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.14.1-2.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-devel-1:24.14.1-2.el10_1.s390x",
                "product": {
                  "name": "nodejs24-devel-1:24.14.1-2.el10_1.s390x",
                  "product_id": "nodejs24-devel-1:24.14.1-2.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-devel@24.14.1-2.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
                "product": {
                  "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
                  "product_id": "nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.14.1-2.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-1:24.14.1-2.el10_1.s390x",
                "product": {
                  "name": "nodejs24-libs-1:24.14.1-2.el10_1.s390x",
                  "product_id": "nodejs24-libs-1:24.14.1-2.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs@24.14.1-2.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
                "product": {
                  "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
                  "product_id": "nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-debugsource@24.14.1-2.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
                "product": {
                  "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
                  "product_id": "nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-debuginfo@24.14.1-2.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
                "product": {
                  "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
                  "product_id": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs-debuginfo@24.14.1-2.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-1:24.14.1-2.el10_1.x86_64",
                "product": {
                  "name": "nodejs24-1:24.14.1-2.el10_1.x86_64",
                  "product_id": "nodejs24-1:24.14.1-2.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.14.1-2.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
                "product": {
                  "name": "nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
                  "product_id": "nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-devel@24.14.1-2.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
                "product": {
                  "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
                  "product_id": "nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.14.1-2.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
                "product": {
                  "name": "nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
                  "product_id": "nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs@24.14.1-2.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
                "product": {
                  "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
                  "product_id": "nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-debugsource@24.14.1-2.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
                "product": {
                  "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
                  "product_id": "nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-debuginfo@24.14.1-2.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
                "product": {
                  "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
                  "product_id": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs-debuginfo@24.14.1-2.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-1:24.14.1-2.el10_1.src",
                "product": {
                  "name": "nodejs24-1:24.14.1-2.el10_1.src",
                  "product_id": "nodejs24-1:24.14.1-2.el10_1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.14.1-2.el10_1?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-1:24.14.1-2.el10_1.aarch64",
                "product": {
                  "name": "nodejs24-1:24.14.1-2.el10_1.aarch64",
                  "product_id": "nodejs24-1:24.14.1-2.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.14.1-2.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
                "product": {
                  "name": "nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
                  "product_id": "nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-devel@24.14.1-2.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
                "product": {
                  "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
                  "product_id": "nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.14.1-2.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
                "product": {
                  "name": "nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
                  "product_id": "nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs@24.14.1-2.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
                "product": {
                  "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
                  "product_id": "nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-debugsource@24.14.1-2.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
                "product": {
                  "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
                  "product_id": "nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-debuginfo@24.14.1-2.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
                "product": {
                  "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
                  "product_id": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs-debuginfo@24.14.1-2.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-1:24.14.1-2.el10_1.ppc64le",
                "product": {
                  "name": "nodejs24-1:24.14.1-2.el10_1.ppc64le",
                  "product_id": "nodejs24-1:24.14.1-2.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.14.1-2.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
                "product": {
                  "name": "nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
                  "product_id": "nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-devel@24.14.1-2.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
                "product": {
                  "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
                  "product_id": "nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.14.1-2.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
                "product": {
                  "name": "nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
                  "product_id": "nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs@24.14.1-2.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
                "product": {
                  "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
                  "product_id": "nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-debugsource@24.14.1-2.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
                "product": {
                  "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
                  "product_id": "nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-debuginfo@24.14.1-2.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
                "product": {
                  "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
                  "product_id": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-libs-debuginfo@24.14.1-2.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-docs-1:24.14.1-2.el10_1.noarch",
                "product": {
                  "name": "nodejs24-docs-1:24.14.1-2.el10_1.noarch",
                  "product_id": "nodejs24-docs-1:24.14.1-2.el10_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-docs@24.14.1-2.el10_1?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch",
                "product": {
                  "name": "nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch",
                  "product_id": "nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-npm@11.11.0-1.24.14.1.2.el10_1?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-1:24.14.1-2.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64"
        },
        "product_reference": "nodejs24-1:24.14.1-2.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-1:24.14.1-2.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le"
        },
        "product_reference": "nodejs24-1:24.14.1-2.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-1:24.14.1-2.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x"
        },
        "product_reference": "nodejs24-1:24.14.1-2.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-1:24.14.1-2.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src"
        },
        "product_reference": "nodejs24-1:24.14.1-2.el10_1.src",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-1:24.14.1-2.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64"
        },
        "product_reference": "nodejs24-1:24.14.1-2.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64"
        },
        "product_reference": "nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le"
        },
        "product_reference": "nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x"
        },
        "product_reference": "nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64"
        },
        "product_reference": "nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64"
        },
        "product_reference": "nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le"
        },
        "product_reference": "nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x"
        },
        "product_reference": "nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64"
        },
        "product_reference": "nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-devel-1:24.14.1-2.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64"
        },
        "product_reference": "nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-devel-1:24.14.1-2.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le"
        },
        "product_reference": "nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-devel-1:24.14.1-2.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x"
        },
        "product_reference": "nodejs24-devel-1:24.14.1-2.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-devel-1:24.14.1-2.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64"
        },
        "product_reference": "nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-docs-1:24.14.1-2.el10_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch"
        },
        "product_reference": "nodejs24-docs-1:24.14.1-2.el10_1.noarch",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64"
        },
        "product_reference": "nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le"
        },
        "product_reference": "nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x"
        },
        "product_reference": "nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64"
        },
        "product_reference": "nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-1:24.14.1-2.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64"
        },
        "product_reference": "nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-1:24.14.1-2.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le"
        },
        "product_reference": "nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-1:24.14.1-2.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x"
        },
        "product_reference": "nodejs24-libs-1:24.14.1-2.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-1:24.14.1-2.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64"
        },
        "product_reference": "nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64"
        },
        "product_reference": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le"
        },
        "product_reference": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x"
        },
        "product_reference": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64"
        },
        "product_reference": "nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        },
        "product_reference": "nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch",
        "relates_to_product_reference": "AppStream-10.1.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1525",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-12T21:01:33.639277+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447144"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., \"Content-Length\" and \"content-length\"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. A flaw in the undici Node.js HTTP/1.1 client allows for HTTP Request Smuggling or Denial of Service. This can occur in Red Hat products that use undici and process HTTP requests where user-controlled header names are not case-normalized, or headers are passed as flat arrays.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447144",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://cwe.mitre.org/data/definitions/444.html",
          "url": "https://cwe.mitre.org/data/definitions/444.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3556037",
          "url": "https://hackerone.com/reports/3556037"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6",
          "url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"
        }
      ],
      "release_date": "2026-03-12T19:56:55.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers"
    },
    {
      "cve": "CVE-2026-1526",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-12T21:01:25.538271+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447142"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a \"decompression bomb,\" during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447142",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3481206",
          "url": "https://hackerone.com/reports/3481206"
        }
      ],
      "release_date": "2026-03-12T20:08:05.950000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression"
    },
    {
      "cve": "CVE-2026-1527",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-03-12T21:01:21.390673+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447141"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici, a Node.js HTTP/1.1 client. This vulnerability allows a remote attacker to inject malicious data into HTTP headers or prematurely end HTTP requests by sending specially crafted input to the `upgrade` option of `client.request()`. This is possible because undici does not properly validate input for invalid header characters, which could lead to unauthorized information disclosure or bypassing of security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: HTTP header injection and request smuggling vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1527"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447141",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447141"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1527",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1527"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1527",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1527"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3487198",
          "url": "https://hackerone.com/reports/3487198"
        }
      ],
      "release_date": "2026-03-12T20:17:18.984000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: HTTP header injection and request smuggling vulnerability"
    },
    {
      "cve": "CVE-2026-1528",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:36.954017+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447145"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici\u0027s ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via crafted WebSocket frame with large length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447145",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1528",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3537648",
          "url": "https://hackerone.com/reports/3537648"
        }
      ],
      "release_date": "2026-03-12T20:21:57.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via crafted WebSocket frame with large length"
    },
    {
      "cve": "CVE-2026-2229",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:29.187989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447143"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client\u0027s Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447143",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2229",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3487486",
          "url": "https://hackerone.com/reports/3487486"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/api/zlib.html#class-zlibinflateraw",
          "url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"
        }
      ],
      "release_date": "2026-03-12T20:27:05.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter"
    },
    {
      "cve": "CVE-2026-2581",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-12T21:01:10.589089+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447140"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Undici. When the `interceptors.deduplicate()` feature is enabled, response data for deduplicated requests can accumulate in memory. A remote attacker, by sending large or chunked responses and concurrent identical requests from an untrusted endpoint, can exploit this uncontrolled resource consumption. This leads to high memory usage and potential Out-Of-Memory (OOM) process termination, resulting in a Denial of Service (DoS) for the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Denial of Service due to uncontrolled resource consumption",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2581"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447140",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447140"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2581",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2581"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2581",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2581"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3513473",
          "url": "https://hackerone.com/reports/3513473"
        }
      ],
      "release_date": "2026-03-12T20:13:19.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: Denial of Service due to uncontrolled resource consumption"
    },
    {
      "cve": "CVE-2026-21637",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-01-20T21:01:26.738343+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431340"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Nodejs denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Systems configured according to Red Hat guidelines should have their services set to restart in the event of a process crash. This Host system service management mitigates the availability impact to Red Hat customers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21637"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431340",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431340"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21637",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21637"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21637",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21637"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"
        }
      ],
      "release_date": "2026-01-20T20:41:55.352000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Nodejs denial of service"
    },
    {
      "cve": "CVE-2026-21710",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:21.196629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header"
    },
    {
      "cve": "CVE-2026-21711",
      "cwe": {
        "id": "CWE-940",
        "name": "Improper Verification of Source of a Communication Channel"
      },
      "discovery_date": "2026-03-30T20:01:55.465001+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453158"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Node.js Permission Model, designed to restrict network access, incorrectly omits permission checks for Unix Domain Socket (UDS) server operations. This allows local code, even when explicitly denied network access, to create and expose inter-process communication (IPC) endpoints. As a result, unauthorized communication can occur between processes on the same host, bypassing the intended network security restrictions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21711"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453158",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453158"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21711",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21711"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21711",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21711"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.526000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks"
    },
    {
      "cve": "CVE-2026-21712",
      "cwe": {
        "id": "CWE-168",
        "name": "Improper Handling of Inconsistent Special Elements"
      },
      "discovery_date": "2026-03-30T16:02:27.812711+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453037"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a malformed Internationalized Domain Name (IDN) to the `url.format()` function. When processed, this malformed input triggers an internal error, causing the Node.js application to crash. This can disrupt services and make them unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21712"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453037",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453037"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21712",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21712"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21712",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21712"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3546390",
          "url": "https://hackerone.com/reports/3546390"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T15:13:59.172000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing"
    },
    {
      "cve": "CVE-2026-21713",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "discovery_date": "2026-03-30T20:02:02.430513+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The HMAC (Hash-based Message Authentication Code) verification process uses a comparison method that does not take a constant amount of time. This non-constant-time comparison can leak timing information, which, under specific conditions where precise timing measurements are possible, could be exploited by a remote attacker. This allows the attacker to infer sensitive HMAC values, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Information disclosure via timing oracle in HMAC verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21713"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21713",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21713"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21713",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21713"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.356000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Node.js: Node.js: Information disclosure via timing oracle in HMAC verification"
    },
    {
      "cve": "CVE-2026-21714",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-03-30T20:02:06.237456+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453161"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability in Node.js HTTP/2 servers by sending specially crafted WINDOW_UPDATE frames on stream 0 (connection-level). These frames can cause the flow control window to exceed its maximum value, leading to a memory leak as Http2Session objects are not properly cleaned up. This can result in resource exhaustion and a Denial of Service (DoS) condition for the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21714"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453161",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453161"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21714",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21714"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21714",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21714"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.317000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames"
    },
    {
      "cve": "CVE-2026-21715",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:25.714444+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453152"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Node.js Permission Model, intended to restrict filesystem access, does not properly enforce read permission checks for the `fs.realpathSync.native()` function. This vulnerability allows code operating under `--permission` with restricted `--allow-fs-read` flags to bypass security controls. Consequently, an attacker can use `fs.realpathSync.native()` to determine file existence, resolve symbolic link targets, and enumerate filesystem paths outside of permitted directories, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21715"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453152",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453152"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21715",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21715"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21715",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21715"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.507000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions"
    },
    {
      "cve": "CVE-2026-21716",
      "cwe": {
        "id": "CWE-279",
        "name": "Incorrect Execution-Assigned Permissions"
      },
      "discovery_date": "2026-03-30T20:01:51.136802+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453157"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An incomplete security fix allows code operating under restricted file system write permissions to bypass these limitations. This vulnerability enables the modification of file permissions and ownership on already-open files, even when explicit write access is denied. Such a bypass could lead to unauthorized changes to system files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21716"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453157",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453157"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21716",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21716"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21716",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21716"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.538000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix."
    },
    {
      "cve": "CVE-2026-21717",
      "cwe": {
        "id": "CWE-328",
        "name": "Use of Weak Hash"
      },
      "discovery_date": "2026-03-30T20:02:10.986695+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453162"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in V8\u0027s string hashing mechanism within Node.js. A remote attacker can exploit this vulnerability by crafting requests containing integer-like strings. These specially crafted strings cause predictable hash collisions in V8\u0027s internal string table, particularly when processed by functions like JSON.parse() on attacker-controlled input. This can significantly degrade the performance of the Node.js process, leading to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21717"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453162",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453162"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21717",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21717"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21717",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21717"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.415000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions"
    },
    {
      "cve": "CVE-2026-25547",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-02-04T22:01:11.784120+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436942"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion component. This denial of service (DoS) vulnerability allows a remote attacker to provide specially crafted input containing repeated numeric brace ranges. This input causes the library to attempt an unbounded expansion, consuming excessive CPU and memory resources. This can lead to a system crash, impacting the availability of the service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436942",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2",
          "url": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2"
        }
      ],
      "release_date": "2026-02-04T21:51:17.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
          "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
          "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:27:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7675"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.src",
            "AppStream-10.1.Z:nodejs24-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-debugsource-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-devel-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-docs-1:24.14.1-2.el10_1.noarch",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-full-i18n-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.s390x",
            "AppStream-10.1.Z:nodejs24-libs-debuginfo-1:24.14.1-2.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs24-npm-1:11.11.0-1.24.14.1.2.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nodejs22 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a platform built on Chrome\u0027s JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7080",
        "url": "https://access.redhat.com/errata/RHSA-2026:7080"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2436942",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
      },
      {
        "category": "external",
        "summary": "2441268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
      },
      {
        "category": "external",
        "summary": "2442922",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
      },
      {
        "category": "external",
        "summary": "2447142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
      },
      {
        "category": "external",
        "summary": "2447143",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
      },
      {
        "category": "external",
        "summary": "2447144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
      },
      {
        "category": "external",
        "summary": "2447145",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2453151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7080.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs22 security update",
    "tracking": {
      "current_release_date": "2026-04-28T20:08:30+00:00",
      "generator": {
        "date": "2026-04-28T20:08:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:7080",
      "initial_release_date": "2026-04-08T13:58:58+00:00",
      "revision_history": [
        {
          "date": "2026-04-08T13:58:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-08T13:58:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T20:08:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.1.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-devel-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-libs-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-devel-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-libs-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-devel-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-libs-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:22.22.2-1.el10_1.noarch",
                "product": {
                  "name": "nodejs-docs-1:22.22.2-1.el10_1.noarch",
                  "product_id": "nodejs-docs-1:22.22.2-1.el10_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@22.22.2-1.el10_1?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs22-1:22.22.2-1.el10_1.src",
                "product": {
                  "name": "nodejs22-1:22.22.2-1.el10_1.src",
                  "product_id": "nodejs22-1:22.22.2-1.el10_1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22@22.22.2-1.el10_1?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:22.22.2-1.el10_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch"
        },
        "product_reference": "nodejs-docs-1:22.22.2-1.el10_1.noarch",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-1:22.22.2-1.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src"
        },
        "product_reference": "nodejs22-1:22.22.2-1.el10_1.src",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1525",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-12T21:01:33.639277+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447144"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., \"Content-Length\" and \"content-length\"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. A flaw in the undici Node.js HTTP/1.1 client allows for HTTP Request Smuggling or Denial of Service. This can occur in Red Hat products that use undici and process HTTP requests where user-controlled header names are not case-normalized, or headers are passed as flat arrays.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447144",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://cwe.mitre.org/data/definitions/444.html",
          "url": "https://cwe.mitre.org/data/definitions/444.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3556037",
          "url": "https://hackerone.com/reports/3556037"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6",
          "url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"
        }
      ],
      "release_date": "2026-03-12T19:56:55.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers"
    },
    {
      "cve": "CVE-2026-1526",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-12T21:01:25.538271+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447142"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a \"decompression bomb,\" during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447142",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3481206",
          "url": "https://hackerone.com/reports/3481206"
        }
      ],
      "release_date": "2026-03-12T20:08:05.950000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression"
    },
    {
      "cve": "CVE-2026-1528",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:36.954017+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447145"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici\u0027s ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via crafted WebSocket frame with large length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447145",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1528",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3537648",
          "url": "https://hackerone.com/reports/3537648"
        }
      ],
      "release_date": "2026-03-12T20:21:57.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via crafted WebSocket frame with large length"
    },
    {
      "cve": "CVE-2026-2229",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:29.187989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447143"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client\u0027s Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447143",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2229",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3487486",
          "url": "https://hackerone.com/reports/3487486"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/api/zlib.html#class-zlibinflateraw",
          "url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"
        }
      ],
      "release_date": "2026-03-12T20:27:05.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter"
    },
    {
      "cve": "CVE-2026-21710",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:21.196629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header"
    },
    {
      "cve": "CVE-2026-25547",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-02-04T22:01:11.784120+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436942"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion component. This denial of service (DoS) vulnerability allows a remote attacker to provide specially crafted input containing repeated numeric brace ranges. This input causes the library to attempt an unbounded expansion, consuming excessive CPU and memory resources. This can lead to a system crash, impacting the availability of the service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436942",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2",
          "url": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2"
        }
      ],
      "release_date": "2026-02-04T21:51:17.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27904",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-26T02:01:23.004531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442922"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442922",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "release_date": "2026-02-26T01:07:42.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nghttp2 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8538",
        "url": "https://access.redhat.com/errata/RHSA-2026:8538"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8538.json"
      }
    ],
    "title": "Red Hat Security Advisory: nghttp2 security update",
    "tracking": {
      "current_release_date": "2026-04-28T18:40:38+00:00",
      "generator": {
        "date": "2026-04-28T18:40:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:8538",
      "initial_release_date": "2026-04-16T18:50:21+00:00",
      "revision_history": [
        {
          "date": "2026-04-16T18:50:21+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-16T18:50:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T18:40:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
                  "product_id": "BaseOS-8.6.0.Z.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_aus:8.6::baseos"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
                  "product_id": "BaseOS-8.6.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_e4s:8.6::baseos"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
                  "product_id": "BaseOS-8.6.0.Z.TUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_tus:8.6::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-4.el8_6.3.i686",
                "product": {
                  "name": "libnghttp2-0:1.33.0-4.el8_6.3.i686",
                  "product_id": "libnghttp2-0:1.33.0-4.el8_6.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-4.el8_6.3?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
                  "product_id": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-4.el8_6.3?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-4.el8_6.3?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-4.el8_6.3?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
                "product": {
                  "name": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
                  "product_id": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-4.el8_6.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
                  "product_id": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-4.el8_6.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-4.el8_6.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-4.el8_6.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-4.el8_6.3.src",
                "product": {
                  "name": "nghttp2-0:1.33.0-4.el8_6.3.src",
                  "product_id": "nghttp2-0:1.33.0-4.el8_6.3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-4.el8_6.3?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-4.el8_6.3.aarch64",
                "product": {
                  "name": "libnghttp2-0:1.33.0-4.el8_6.3.aarch64",
                  "product_id": "libnghttp2-0:1.33.0-4.el8_6.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-4.el8_6.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64",
                  "product_id": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-4.el8_6.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-4.el8_6.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-4.el8_6.3?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-4.el8_6.3.ppc64le",
                "product": {
                  "name": "libnghttp2-0:1.33.0-4.el8_6.3.ppc64le",
                  "product_id": "libnghttp2-0:1.33.0-4.el8_6.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-4.el8_6.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le",
                  "product_id": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-4.el8_6.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-4.el8_6.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-4.el8_6.3?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-4.el8_6.3.s390x",
                "product": {
                  "name": "libnghttp2-0:1.33.0-4.el8_6.3.s390x",
                  "product_id": "libnghttp2-0:1.33.0-4.el8_6.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-4.el8_6.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x",
                  "product_id": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-4.el8_6.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-4.el8_6.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-4.el8_6.3?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-4.el8_6.3.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:nghttp2-0:1.33.0-4.el8_6.3.src"
        },
        "product_reference": "nghttp2-0:1.33.0-4.el8_6.3.src",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.aarch64"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.aarch64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.ppc64le",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.s390x"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.s390x",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-4.el8_6.3.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-0:1.33.0-4.el8_6.3.src"
        },
        "product_reference": "nghttp2-0:1.33.0-4.el8_6.3.src",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:libnghttp2-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:libnghttp2-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-4.el8_6.3.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:nghttp2-0:1.33.0-4.el8_6.3.src"
        },
        "product_reference": "nghttp2-0:1.33.0-4.el8_6.3.src",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.6)",
          "product_id": "BaseOS-8.6.0.Z.TUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.6.0.Z.TUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.6.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.AUS:nghttp2-0:1.33.0-4.el8_6.3.src",
          "BaseOS-8.6.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.aarch64",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.ppc64le",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.s390x",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
          "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.E4S:nghttp2-0:1.33.0-4.el8_6.3.src",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x",
          "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.TUS:libnghttp2-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.TUS:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.TUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.TUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.TUS:nghttp2-0:1.33.0-4.el8_6.3.src",
          "BaseOS-8.6.0.Z.TUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.TUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
          "BaseOS-8.6.0.Z.TUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
          "BaseOS-8.6.0.Z.TUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T18:50:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.6.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.AUS:nghttp2-0:1.33.0-4.el8_6.3.src",
            "BaseOS-8.6.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.aarch64",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.ppc64le",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.s390x",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.E4S:nghttp2-0:1.33.0-4.el8_6.3.src",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.TUS:libnghttp2-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.TUS:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.TUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.TUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.TUS:nghttp2-0:1.33.0-4.el8_6.3.src",
            "BaseOS-8.6.0.Z.TUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.TUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.TUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.TUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8538"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.6.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.AUS:nghttp2-0:1.33.0-4.el8_6.3.src",
            "BaseOS-8.6.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.aarch64",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.ppc64le",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.s390x",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
            "BaseOS-8.6.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.E4S:nghttp2-0:1.33.0-4.el8_6.3.src",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.aarch64",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.ppc64le",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.s390x",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.aarch64",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.ppc64le",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.s390x",
            "BaseOS-8.6.0.Z.E4S:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.TUS:libnghttp2-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.TUS:libnghttp2-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.TUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.TUS:libnghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.TUS:nghttp2-0:1.33.0-4.el8_6.3.src",
            "BaseOS-8.6.0.Z.TUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.TUS:nghttp2-debuginfo-0:1.33.0-4.el8_6.3.x86_64",
            "BaseOS-8.6.0.Z.TUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.i686",
            "BaseOS-8.6.0.Z.TUS:nghttp2-debugsource-0:1.33.0-4.el8_6.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images.\nThis release updates to the latest version.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:10065",
        "url": "https://access.redhat.com/errata/RHSA-2026:10065"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/red-hat-update-infrastructure",
        "url": "https://access.redhat.com/products/red-hat-update-infrastructure"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-40403",
        "url": "https://access.redhat.com/security/cve/CVE-2023-40403"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-1642",
        "url": "https://access.redhat.com/security/cve/CVE-2026-1642"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25749",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25749"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27135",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27651",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27651"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27654",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27654"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27784",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27784"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-28417",
        "url": "https://access.redhat.com/security/cve/CVE-2026-28417"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-28421",
        "url": "https://access.redhat.com/security/cve/CVE-2026-28421"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32647",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32647"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33412",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33412"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-3497",
        "url": "https://access.redhat.com/security/cve/CVE-2026-3497"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4111",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4111"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4424",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4424"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4519",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4519"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-5121",
        "url": "https://access.redhat.com/security/cve/CVE-2026-5121"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5",
        "url": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10065.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update",
    "tracking": {
      "current_release_date": "2026-04-29T09:52:53+00:00",
      "generator": {
        "date": "2026-04-29T09:52:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.7"
        }
      },
      "id": "RHSA-2026:10065",
      "initial_release_date": "2026-04-23T06:06:23+00:00",
      "revision_history": [
        {
          "date": "2026-04-23T06:06:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-23T06:06:26+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-29T09:52:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Update Infrastructure 5",
                "product": {
                  "name": "Red Hat Update Infrastructure 5",
                  "product_id": "Red Hat Update Infrastructure 5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhui:5::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Update Infrastructure"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
                  "product_id": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cds-rhel9@sha256%3A8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930?arch=amd64\u0026repository_url=registry.redhat.io/rhui5\u0026tag=1776868774"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
                  "product_id": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/haproxy-rhel9@sha256%3A8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709?arch=amd64\u0026repository_url=registry.redhat.io/rhui5\u0026tag=1776868744"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
                  "product_id": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/installer-rhel9@sha256%3A8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe?arch=amd64\u0026repository_url=registry.redhat.io/rhui5\u0026tag=1776868772"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64",
                  "product_id": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhua-rhel9@sha256%3A7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed?arch=amd64\u0026repository_url=registry.redhat.io/rhui5\u0026tag=1776868842"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40403",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2025-03-04T12:01:50.826520+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2349766"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxslt: Processing web content may disclose sensitive information",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE is a duplicate of CVE-2022-4909.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "RHBZ#2349766",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349766"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40403",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/10",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/10"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/3",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/3"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/4",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/4"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/5",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/5"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/6",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/6"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/8",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/8"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/9",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/9"
        },
        {
          "category": "external",
          "summary": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211",
          "url": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.gnome.org/show_bug.cgi?id=751621",
          "url": "https://bugzilla.gnome.org/show_bug.cgi?id=751621"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94",
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94"
        },
        {
          "category": "external",
          "summary": "https://support.apple.com/en-us/HT213927",
          "url": "https://support.apple.com/en-us/HT213927"
        }
      ],
      "release_date": "2023-09-26T20:14:54.697000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxslt: Processing web content may disclose sensitive information"
    },
    {
      "cve": "CVE-2026-1642",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "discovery_date": "2026-02-04T16:00:52.156255+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436738"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX. When NGINX is configured to proxy to upstream Transport Layer Security (TLS) servers, An attacker with a man-in-the-middle (MITM) position on the upstream server side\u2014along with conditions beyond the attacker\u0027s control\u2014may be able to inject plain text data into the response from an upstream proxied server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1642"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436738",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436738"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1642",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1642"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1642",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1642"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000159824",
          "url": "https://my.f5.com/manage/s/article/K000159824"
        }
      ],
      "release_date": "2026-02-04T15:02:06.154000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections"
    },
    {
      "cve": "CVE-2026-3497",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-03-12T19:01:37.007806+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "IMPORTANT: This vulnerability affects the OpenSSH GSSAPI delta as implemented in Red Hat Enterprise Linux and OpenShift Container Platform. An unauthenticated attacker could send a specially crafted GSSAPI message during key exchange, leading to the use of uninitialized variables and potentially undefined behavior. The severity of the impact is dependent on compiler hardening configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3497",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://ubuntu.com/security/CVE-2026-3497",
          "url": "https://ubuntu.com/security/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/03/12/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/03/12/3"
        }
      ],
      "release_date": "2026-03-12T18:27:44.917000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability\u0027s attack surface.\n\nEdit `/etc/ssh/sshd_config` and add or modify the line:\n```\nGSSAPIKeyExchange no\n```\n\nAfter saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI.\n\n```\n# systemctl restart sshd\n```",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Elhanan Haenel"
          ]
        }
      ],
      "cve": "CVE-2026-4111",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-03-11T11:18:51.609000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2446453"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team would likely assess the severity of this vulnerability as High because it allows remote attackers to cause a persistent denial-of-service condition using a small crafted archive file. Successful exploitation requires no authentication, no special configuration, and no user interaction in environments that automatically process uploaded archives. By repeatedly submitting malicious archives, an attacker can exhaust CPU resources or worker threads in services such as file upload systems, CI/CD pipelines, mail scanners, and content indexing services that rely on libarchive for archive extraction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2446453",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2877",
          "url": "https://github.com/libarchive/libarchive/pull/2877"
        }
      ],
      "release_date": "2026-03-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Elhanan Haenel"
          ]
        }
      ],
      "cve": "CVE-2026-4424",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-03-19T12:22:21.740000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449006"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "IMPORTANT: This heap out-of-bounds read vulnerability in libarchive\u0027s RAR archive processing logic can lead to information disclosure. A remote attacker can exploit this flaw by providing a specially crafted RAR archive, potentially revealing sensitive heap memory information without requiring authentication or user interaction on systems that process untrusted archives.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449006",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4424",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2898",
          "url": "https://github.com/libarchive/libarchive/pull/2898"
        }
      ],
      "release_date": "2026-03-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing"
    },
    {
      "cve": "CVE-2026-4519",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-03-20T16:02:13.494105+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449649"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449649",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143930",
          "url": "https://github.com/python/cpython/issues/143930"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143931",
          "url": "https://github.com/python/cpython/pull/143931"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
        }
      ],
      "release_date": "2026-03-20T15:08:32.576000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Elhanan Haenel"
          ]
        }
      ],
      "cve": "CVE-2026-5121",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-03-30T07:40:25.358335+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452945"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: An integer overflow flaw in `libarchive` on 32-bit systems can lead to a heap buffer overflow. This vulnerability occurs when processing a specially crafted ISO9660 image, allowing an attacker to potentially execute arbitrary code. Red Hat Enterprise Linux 64-bit systems are not affected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452945",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452945"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc",
          "url": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2934",
          "url": "https://github.com/libarchive/libarchive/pull/2934"
        }
      ],
      "release_date": "2026-03-30T07:44:15.222000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing"
    },
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-25749",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-02-09T11:08:59.061581+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437843"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open source, command line text editor. This heap buffer overflow vulnerability exists in the tag file resolution logic when processing the \u0027helpfile\u0027 option. A local user could exploit this by providing a specially crafted \u0027helpfile\u0027 option value, leading to a heap buffer overflow. This could result in arbitrary code execution or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via \u0027helpfile\u0027 option processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This MODERATE impact vulnerability in Vim\u0027s tag file resolution logic allows a local attacker to achieve a out-of-bounds write. By providing a specially crafted `helpfile` option value a local user can trigger a heap buffer overflow, as consequence lead to memory corruption presenting a data integrity impact or leading the vim process to crash resulting in availability impact. Although being non-trivial and very complex, arbitrary code execution is not discarded as worst case scenario.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25749"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437843",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437843"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25749",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25749"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25749",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25749"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9",
          "url": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.1.2132",
          "url": "https://github.com/vim/vim/releases/tag/v9.1.2132"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43"
        }
      ],
      "release_date": "2026-02-06T22:43:38.630000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via \u0027helpfile\u0027 option processing"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27651",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-03-24T15:02:32.414082+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450791"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX, specifically within the ngx_mail_auth_http_module. When this module is enabled, and CRAM-MD5 or APOP authentication is active with an authentication server that permits retries, undisclosed requests can cause NGINX worker processes to terminate. This can lead to a Denial of Service (DoS), making the affected NGINX instance unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27651"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450791",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450791"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27651",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27651"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27651",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27651"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000160383",
          "url": "https://my.f5.com/manage/s/article/K000160383"
        }
      ],
      "release_date": "2026-03-24T14:13:27.295000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled"
    },
    {
      "cve": "CVE-2026-27654",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-03-24T15:01:19.814138+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450776"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX. A remote attacker can exploit a buffer overflow vulnerability within the ngx_http_dav_module module. This occurs when the NGINX configuration uses DAV module MOVE or COPY methods in conjunction with prefix location and alias directives. Successful exploitation may lead to the termination of the NGINX worker process, resulting in a Denial of Service (DoS), or allow for the modification of source or destination file names outside the intended document root.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27654"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450776",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450776"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27654",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27654"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27654",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27654"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000160382",
          "url": "https://my.f5.com/manage/s/article/K000160382"
        }
      ],
      "release_date": "2026-03-24T14:13:26.879000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module"
    },
    {
      "cve": "CVE-2026-27784",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-03-24T15:02:07.092253+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450785"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX Open Source, specifically within the ngx_http_mp4_module. An attacker can exploit this memory corruption vulnerability by providing a specially crafted MP4 file. This can lead to an over-read or over-write of NGINX worker memory, causing the worker to terminate and resulting in a Denial of Service (DoS). This issue affects 32-bit NGINX Open Source when built with the ngx_http_mp4_module and the mp4 directive is used.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27784"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450785",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450785"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27784",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27784"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27784",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27784"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000160364",
          "url": "https://my.f5.com/manage/s/article/K000160364"
        }
      ],
      "release_date": "2026-03-24T14:13:25.343000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file"
    },
    {
      "cve": "CVE-2026-28417",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-02-27T22:01:53.728412+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443455"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system (OS) command injection vulnerability exists in the `netrw` standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the `scp://` protocol handler. Successful exploitation allows the attacker to execute arbitrary shell commands with the same privileges as the Vim process, leading to potential system compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features which are enabled by default. The impacts of this flaw will be limited by the active user\u0027s permissions and access control limits. Host systems are not at risk when following Red Hat guidelines and the root user account is not actively executing Vim.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28417"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443455",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443455"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28417",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28417"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28417",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28417"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/79348dbbc09332130f4c860",
          "url": "https://github.com/vim/vim/commit/79348dbbc09332130f4c860"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0073",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0073"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336"
        }
      ],
      "release_date": "2026-02-27T21:54:35.196000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin"
    },
    {
      "cve": "CVE-2026-28421",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-02-27T23:01:44.673504+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443474"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim. This vulnerability, a heap-buffer-overflow and a segmentation fault, exists in the swap file recovery logic. A local attacker could exploit this by providing a specially crafted swap file. This could lead to a denial of service (DoS) or potentially information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of service and information disclosure via crafted swap file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features which are enabled by default. The impacts of this flaw will be limited by the active user\u0027s permissions and access control limits. Host systems are not at risk when following Red Hat guidelines and the root user account is not actively executing Vim.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28421"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443474",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443474"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28421",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28421"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28421",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28421"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/65c1a143c331c886dc28",
          "url": "https://github.com/vim/vim/commit/65c1a143c331c886dc28"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0077",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0077"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p"
        }
      ],
      "release_date": "2026-02-27T22:06:34.312000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of service and information disclosure via crafted swap file"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pavel Kohout"
          ],
          "organization": "Aisle Research"
        }
      ],
      "cve": "CVE-2026-32647",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-03-20T11:44:34.715000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449598"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX\u0027s ngx_http_mp4_module. This Out-of-Bounds Read/Write vulnerability occurs due to improper handling of specially crafted MP4 files. A local authenticated attacker, by supplying a malicious MP4 file, can trigger a buffer over-read or overwrite in worker memory. This can lead to process termination, potentially causing a denial-of-service or, under certain conditions, achieving code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This IMPORTANT vulnerability in the NGINX ngx_http_mp4_module is due to improper handling of specially crafted MP4 files. A local authenticated attacker could exploit this flaw by providing a malicious MP4 file, leading to a denial of service or potentially arbitrary code execution. Red Hat products utilizing NGINX with the ngx_http_mp4_module enabled are affected if untrusted MP4 files are processed.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32647"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449598",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449598"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32647",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32647"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32647",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32647"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000160366",
          "url": "https://my.f5.com/manage/s/article/K000160366"
        }
      ],
      "release_date": "2026-03-24T18:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the ngx_http_mp4_module in your NGINX configuration if MP4 file processing is not required. This can be done by commenting out or removing the mp4 directive from the NGINX configuration file. After modifying the configuration, a reload or restart of the NGINX service is required for the changes to take effect.\n\nAlternatively, restrict access to the NGINX server to trusted networks and users to prevent the upload and processing of malicious MP4 files.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files"
    },
    {
      "cve": "CVE-2026-33412",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-03-24T20:02:21.511965+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450907"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim. By including a newline character in a pattern passed to Vim\u0027s glob() function, an attacker may be able to execute arbitrary shell commands. This command injection vulnerability allows for arbitrary code execution, depending on the user\u0027s shell settings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via command injection in glob() function",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33412"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450907",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450907"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33412",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33412"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33412",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33412"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a",
          "url": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0202",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0202"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c"
        }
      ],
      "release_date": "2026-03-24T19:43:07.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via command injection in glob() function"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7302",
        "url": "https://access.redhat.com/errata/RHSA-2026:7302"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2436942",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
      },
      {
        "category": "external",
        "summary": "2441268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
      },
      {
        "category": "external",
        "summary": "2442922",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
      },
      {
        "category": "external",
        "summary": "2447142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
      },
      {
        "category": "external",
        "summary": "2447143",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
      },
      {
        "category": "external",
        "summary": "2447144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
      },
      {
        "category": "external",
        "summary": "2447145",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2453151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7302.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:22 security update",
    "tracking": {
      "current_release_date": "2026-04-28T20:08:32+00:00",
      "generator": {
        "date": "2026-04-28T20:08:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:7302",
      "initial_release_date": "2026-04-09T13:04:58+00:00",
      "revision_history": [
        {
          "date": "2026-04-09T13:04:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-09T13:04:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T20:08:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.7.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=src\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src (nodejs:22)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=src\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src (nodejs:22)",
                  "product_id": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=src\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch (nodejs:22)",
                  "product_id": "nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch (nodejs:22)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=noarch\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch (nodejs:22)",
                  "product_id": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=noarch\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch (nodejs:22)",
                  "product_id": "nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-6.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=noarch\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.7-1.22.22.2.1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.22.2.1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=aarch64\u0026epoch=3\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.7-1.22.22.2.1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.22.2.1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=ppc64le\u0026epoch=3\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.7-1.22.22.2.1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.22.2.1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=s390x\u0026epoch=3\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.7-1.22.22.2.1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.22.2.1.module%2Bel9.7.0%2B24157%2B8ddb2461?arch=x86_64\u0026epoch=3\u0026rpmmod=nodejs:22:9070020260401095228:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22"
        },
        "product_reference": "nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22"
        },
        "product_reference": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22"
        },
        "product_reference": "nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22"
        },
        "product_reference": "nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1525",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-12T21:01:33.639277+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447144"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., \"Content-Length\" and \"content-length\"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. A flaw in the undici Node.js HTTP/1.1 client allows for HTTP Request Smuggling or Denial of Service. This can occur in Red Hat products that use undici and process HTTP requests where user-controlled header names are not case-normalized, or headers are passed as flat arrays.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447144",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://cwe.mitre.org/data/definitions/444.html",
          "url": "https://cwe.mitre.org/data/definitions/444.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3556037",
          "url": "https://hackerone.com/reports/3556037"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6",
          "url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"
        }
      ],
      "release_date": "2026-03-12T19:56:55.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers"
    },
    {
      "cve": "CVE-2026-1526",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-12T21:01:25.538271+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447142"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a \"decompression bomb,\" during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447142",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3481206",
          "url": "https://hackerone.com/reports/3481206"
        }
      ],
      "release_date": "2026-03-12T20:08:05.950000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression"
    },
    {
      "cve": "CVE-2026-1528",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:36.954017+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447145"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici\u0027s ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via crafted WebSocket frame with large length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447145",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1528",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3537648",
          "url": "https://hackerone.com/reports/3537648"
        }
      ],
      "release_date": "2026-03-12T20:21:57.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via crafted WebSocket frame with large length"
    },
    {
      "cve": "CVE-2026-2229",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:29.187989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447143"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client\u0027s Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447143",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2229",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3487486",
          "url": "https://hackerone.com/reports/3487486"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/api/zlib.html#class-zlibinflateraw",
          "url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"
        }
      ],
      "release_date": "2026-03-12T20:27:05.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter"
    },
    {
      "cve": "CVE-2026-21710",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:21.196629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header"
    },
    {
      "cve": "CVE-2026-25547",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-02-04T22:01:11.784120+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436942"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion component. This denial of service (DoS) vulnerability allows a remote attacker to provide specially crafted input containing repeated numeric brace ranges. This input causes the library to attempt an unbounded expansion, consuming excessive CPU and memory resources. This can lead to a system crash, impacting the availability of the service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436942",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2",
          "url": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2"
        }
      ],
      "release_date": "2026-02-04T21:51:17.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27904",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-26T02:01:23.004531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442922"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
          "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442922",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "release_date": "2026-02-26T01:07:42.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-09T13:04:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7302"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-debugsource-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-devel-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-docs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-full-i18n-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-libs-debuginfo-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-nodemon-0:3.0.1-1.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.7.0+24157+8ddb2461.src::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.7.0+24157+8ddb2461.noarch::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:npm-1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22",
            "AppStream-9.7.0.Z.MAIN:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nghttp2 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8539",
        "url": "https://access.redhat.com/errata/RHSA-2026:8539"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8539.json"
      }
    ],
    "title": "Red Hat Security Advisory: nghttp2 security update",
    "tracking": {
      "current_release_date": "2026-04-28T18:40:39+00:00",
      "generator": {
        "date": "2026-04-28T18:40:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:8539",
      "initial_release_date": "2026-04-16T18:43:16+00:00",
      "revision_history": [
        {
          "date": "2026-04-16T18:43:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-16T18:43:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T18:40:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
                  "product_id": "BaseOS-8.4.0.Z.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_aus:8.4::baseos"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
                  "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-4.el8_4.3.i686",
                "product": {
                  "name": "libnghttp2-0:1.33.0-4.el8_4.3.i686",
                  "product_id": "libnghttp2-0:1.33.0-4.el8_4.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-4.el8_4.3?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
                  "product_id": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-4.el8_4.3?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-4.el8_4.3?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-4.el8_4.3?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
                "product": {
                  "name": "libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
                  "product_id": "libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-4.el8_4.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64",
                  "product_id": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-4.el8_4.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-4.el8_4.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-4.el8_4.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-4.el8_4.3.src",
                "product": {
                  "name": "nghttp2-0:1.33.0-4.el8_4.3.src",
                  "product_id": "nghttp2-0:1.33.0-4.el8_4.3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-4.el8_4.3?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_4.3.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_4.3.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_4.3.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-4.el8_4.3.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:nghttp2-0:1.33.0-4.el8_4.3.src"
        },
        "product_reference": "nghttp2-0:1.33.0-4.el8_4.3.src",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-0:1.33.0-4.el8_4.3.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_4.3.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-4.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-0:1.33.0-4.el8_4.3.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-4.el8_4.3.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-0:1.33.0-4.el8_4.3.src"
        },
        "product_reference": "nghttp2-0:1.33.0-4.el8_4.3.src",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)",
          "product_id": "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.Z.EUS.EXTENSION"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.4.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_4.3.i686",
          "BaseOS-8.4.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
          "BaseOS-8.4.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
          "BaseOS-8.4.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
          "BaseOS-8.4.0.Z.AUS:nghttp2-0:1.33.0-4.el8_4.3.src",
          "BaseOS-8.4.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
          "BaseOS-8.4.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
          "BaseOS-8.4.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
          "BaseOS-8.4.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-0:1.33.0-4.el8_4.3.i686",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-0:1.33.0-4.el8_4.3.src",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
          "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T18:43:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.4.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.AUS:nghttp2-0:1.33.0-4.el8_4.3.src",
            "BaseOS-8.4.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-0:1.33.0-4.el8_4.3.src",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8539"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.4.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.AUS:libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.AUS:nghttp2-0:1.33.0-4.el8_4.3.src",
            "BaseOS-8.4.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.AUS:nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:libnghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-0:1.33.0-4.el8_4.3.src",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debuginfo-0:1.33.0-4.el8_4.3.x86_64",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debugsource-0:1.33.0-4.el8_4.3.i686",
            "BaseOS-8.4.0.Z.EUS.EXTENSION:nghttp2-debugsource-0:1.33.0-4.el8_4.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nghttp2 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8541",
        "url": "https://access.redhat.com/errata/RHSA-2026:8541"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8541.json"
      }
    ],
    "title": "Red Hat Security Advisory: nghttp2 security update",
    "tracking": {
      "current_release_date": "2026-04-28T18:40:40+00:00",
      "generator": {
        "date": "2026-04-28T18:40:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:8541",
      "initial_release_date": "2026-04-16T18:40:31+00:00",
      "revision_history": [
        {
          "date": "2026-04-16T18:40:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-16T18:40:31+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T18:40:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
                  "product_id": "BaseOS-8.2.0.Z.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_aus:8.2::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-3.el8_2.4.i686",
                "product": {
                  "name": "libnghttp2-0:1.33.0-3.el8_2.4.i686",
                  "product_id": "libnghttp2-0:1.33.0-3.el8_2.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-3.el8_2.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686",
                  "product_id": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-3.el8_2.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-3.el8_2.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-3.el8_2.4?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-3.el8_2.4.x86_64",
                "product": {
                  "name": "libnghttp2-0:1.33.0-3.el8_2.4.x86_64",
                  "product_id": "libnghttp2-0:1.33.0-3.el8_2.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-3.el8_2.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64",
                  "product_id": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-3.el8_2.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-3.el8_2.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-3.el8_2.4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-3.el8_2.4.src",
                "product": {
                  "name": "nghttp2-0:1.33.0-3.el8_2.4.src",
                  "product_id": "nghttp2-0:1.33.0-3.el8_2.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-3.el8_2.4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-3.el8_2.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:libnghttp2-0:1.33.0-3.el8_2.4.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-3.el8_2.4.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-3.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:libnghttp2-0:1.33.0-3.el8_2.4.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-3.el8_2.4.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-3.el8_2.4.src as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:nghttp2-0:1.33.0-3.el8_2.4.src"
        },
        "product_reference": "nghttp2-0:1.33.0-3.el8_2.4.src",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:libnghttp2-0:1.33.0-3.el8_2.4.i686",
          "BaseOS-8.2.0.Z.AUS:libnghttp2-0:1.33.0-3.el8_2.4.x86_64",
          "BaseOS-8.2.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
          "BaseOS-8.2.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
          "BaseOS-8.2.0.Z.AUS:nghttp2-0:1.33.0-3.el8_2.4.src",
          "BaseOS-8.2.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
          "BaseOS-8.2.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
          "BaseOS-8.2.0.Z.AUS:nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686",
          "BaseOS-8.2.0.Z.AUS:nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T18:40:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:libnghttp2-0:1.33.0-3.el8_2.4.i686",
            "BaseOS-8.2.0.Z.AUS:libnghttp2-0:1.33.0-3.el8_2.4.x86_64",
            "BaseOS-8.2.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
            "BaseOS-8.2.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
            "BaseOS-8.2.0.Z.AUS:nghttp2-0:1.33.0-3.el8_2.4.src",
            "BaseOS-8.2.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
            "BaseOS-8.2.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
            "BaseOS-8.2.0.Z.AUS:nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686",
            "BaseOS-8.2.0.Z.AUS:nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8541"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:libnghttp2-0:1.33.0-3.el8_2.4.i686",
            "BaseOS-8.2.0.Z.AUS:libnghttp2-0:1.33.0-3.el8_2.4.x86_64",
            "BaseOS-8.2.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
            "BaseOS-8.2.0.Z.AUS:libnghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
            "BaseOS-8.2.0.Z.AUS:nghttp2-0:1.33.0-3.el8_2.4.src",
            "BaseOS-8.2.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-3.el8_2.4.i686",
            "BaseOS-8.2.0.Z.AUS:nghttp2-debuginfo-0:1.33.0-3.el8_2.4.x86_64",
            "BaseOS-8.2.0.Z.AUS:nghttp2-debugsource-0:1.33.0-3.el8_2.4.i686",
            "BaseOS-8.2.0.Z.AUS:nghttp2-debugsource-0:1.33.0-3.el8_2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nghttp2 is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7667",
        "url": "https://access.redhat.com/errata/RHSA-2026:7667"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7667.json"
      }
    ],
    "title": "Red Hat Security Advisory: nghttp2 security update",
    "tracking": {
      "current_release_date": "2026-04-28T18:40:30+00:00",
      "generator": {
        "date": "2026-04-28T18:40:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:7667",
      "initial_release_date": "2026-04-13T02:25:06+00:00",
      "revision_history": [
        {
          "date": "2026-04-13T02:25:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-13T02:25:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T18:40:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                  "product_id": "BaseOS-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux CRB (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux CRB (v. 8)",
                  "product_id": "CRB-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
                "product": {
                  "name": "libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
                  "product_id": "libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
                  "product_id": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-6.el8_10.2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-6.el8_10.2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-6.el8_10.2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
                "product": {
                  "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
                  "product_id": "libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.33.0-6.el8_10.2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-6.el8_10.2.aarch64",
                "product": {
                  "name": "nghttp2-0:1.33.0-6.el8_10.2.aarch64",
                  "product_id": "nghttp2-0:1.33.0-6.el8_10.2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-6.el8_10.2?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
                "product": {
                  "name": "libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_id": "libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_id": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-6.el8_10.2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-6.el8_10.2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-6.el8_10.2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
                "product": {
                  "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_id": "libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.33.0-6.el8_10.2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
                "product": {
                  "name": "nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_id": "nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-6.el8_10.2?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-6.el8_10.2.i686",
                "product": {
                  "name": "libnghttp2-0:1.33.0-6.el8_10.2.i686",
                  "product_id": "libnghttp2-0:1.33.0-6.el8_10.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
                  "product_id": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-6.el8_10.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-6.el8_10.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-6.el8_10.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
                "product": {
                  "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
                  "product_id": "libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.33.0-6.el8_10.2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
                "product": {
                  "name": "libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
                  "product_id": "libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64",
                  "product_id": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-6.el8_10.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-6.el8_10.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-6.el8_10.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
                "product": {
                  "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
                  "product_id": "libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.33.0-6.el8_10.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-6.el8_10.2.x86_64",
                "product": {
                  "name": "nghttp2-0:1.33.0-6.el8_10.2.x86_64",
                  "product_id": "nghttp2-0:1.33.0-6.el8_10.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-6.el8_10.2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-6.el8_10.2.s390x",
                "product": {
                  "name": "libnghttp2-0:1.33.0-6.el8_10.2.s390x",
                  "product_id": "libnghttp2-0:1.33.0-6.el8_10.2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
                  "product_id": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-6.el8_10.2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-6.el8_10.2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-6.el8_10.2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
                "product": {
                  "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
                  "product_id": "libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-devel@1.33.0-6.el8_10.2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-6.el8_10.2.s390x",
                "product": {
                  "name": "nghttp2-0:1.33.0-6.el8_10.2.s390x",
                  "product_id": "nghttp2-0:1.33.0-6.el8_10.2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-6.el8_10.2?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-6.el8_10.2.src",
                "product": {
                  "name": "nghttp2-0:1.33.0-6.el8_10.2.src",
                  "product_id": "nghttp2-0:1.33.0-6.el8_10.2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-6.el8_10.2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.src"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.src",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.src as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.src"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.src",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "nghttp2-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.i686",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.src",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.x86_64",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-13T02:25:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.src",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7667"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.src",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7123",
        "url": "https://access.redhat.com/errata/RHSA-2026:7123"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2436942",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
      },
      {
        "category": "external",
        "summary": "2441268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
      },
      {
        "category": "external",
        "summary": "2442922",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
      },
      {
        "category": "external",
        "summary": "2447142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
      },
      {
        "category": "external",
        "summary": "2447143",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
      },
      {
        "category": "external",
        "summary": "2447144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
      },
      {
        "category": "external",
        "summary": "2447145",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2453151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
      },
      {
        "category": "external",
        "summary": "RHEL-154019",
        "url": "https://issues.redhat.com/browse/RHEL-154019"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7123.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:22 security update",
    "tracking": {
      "current_release_date": "2026-04-28T20:08:31+00:00",
      "generator": {
        "date": "2026-04-28T20:08:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.6"
        }
      },
      "id": "RHSA-2026:7123",
      "initial_release_date": "2026-04-08T18:17:58+00:00",
      "revision_history": [
        {
          "date": "2026-04-08T18:17:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-08T18:17:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T20:08:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=src\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src (nodejs:22)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=src\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src (nodejs:22)",
                  "product_id": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel8.10.0%2B24148%2B847b6786?arch=src\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch (nodejs:22)",
                  "product_id": "nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch (nodejs:22)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=noarch\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch (nodejs:22)",
                  "product_id": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel8.10.0%2B24148%2B847b6786?arch=noarch\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
                "product": {
                  "name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch (nodejs:22)",
                  "product_id": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-6.module%2Bel8.10.0%2B24148%2B847b6786?arch=noarch\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.7-1.22.22.2.1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.22.2.1.module%2Bel8.10.0%2B24148%2B847b6786?arch=aarch64\u0026epoch=3\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.7-1.22.22.2.1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.22.2.1.module%2Bel8.10.0%2B24148%2B847b6786?arch=ppc64le\u0026epoch=3\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.7-1.22.22.2.1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.22.2.1.module%2Bel8.10.0%2B24148%2B847b6786?arch=s390x\u0026epoch=3\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@10.9.7-1.22.22.2.1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                "product": {
                  "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22)",
                  "product_id": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-12.4-devel@12.4.254.21-1.22.22.2.1.module%2Bel8.10.0%2B24148%2B847b6786?arch=x86_64\u0026epoch=3\u0026rpmmod=nodejs:22:8100020260331102257:6d880403"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22"
        },
        "product_reference": "nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22"
        },
        "product_reference": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22"
        },
        "product_reference": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22"
        },
        "product_reference": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        },
        "product_reference": "v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1525",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-12T21:01:33.639277+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447144"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., \"Content-Length\" and \"content-length\"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. A flaw in the undici Node.js HTTP/1.1 client allows for HTTP Request Smuggling or Denial of Service. This can occur in Red Hat products that use undici and process HTTP requests where user-controlled header names are not case-normalized, or headers are passed as flat arrays.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447144",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://cwe.mitre.org/data/definitions/444.html",
          "url": "https://cwe.mitre.org/data/definitions/444.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3556037",
          "url": "https://hackerone.com/reports/3556037"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6",
          "url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"
        }
      ],
      "release_date": "2026-03-12T19:56:55.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers"
    },
    {
      "cve": "CVE-2026-1526",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-12T21:01:25.538271+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447142"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a \"decompression bomb,\" during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447142",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3481206",
          "url": "https://hackerone.com/reports/3481206"
        }
      ],
      "release_date": "2026-03-12T20:08:05.950000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression"
    },
    {
      "cve": "CVE-2026-1528",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:36.954017+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447145"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici\u0027s ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via crafted WebSocket frame with large length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447145",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1528",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3537648",
          "url": "https://hackerone.com/reports/3537648"
        }
      ],
      "release_date": "2026-03-12T20:21:57.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via crafted WebSocket frame with large length"
    },
    {
      "cve": "CVE-2026-2229",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:29.187989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447143"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client\u0027s Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447143",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2229",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3487486",
          "url": "https://hackerone.com/reports/3487486"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/api/zlib.html#class-zlibinflateraw",
          "url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"
        }
      ],
      "release_date": "2026-03-12T20:27:05.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter"
    },
    {
      "cve": "CVE-2026-21710",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:21.196629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header"
    },
    {
      "cve": "CVE-2026-25547",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-02-04T22:01:11.784120+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436942"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion component. This denial of service (DoS) vulnerability allows a remote attacker to provide specially crafted input containing repeated numeric brace ranges. This input causes the library to attempt an unbounded expansion, consuming excessive CPU and memory resources. This can lead to a system crash, impacting the availability of the service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436942",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2",
          "url": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2"
        }
      ],
      "release_date": "2026-02-04T21:51:17.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27904",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-26T02:01:23.004531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442922"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
          "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442922",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "release_date": "2026-02-26T01:07:42.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T18:17:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7123"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.src::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:npm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.s390x::nodejs:22",
            "AppStream-8.10.0.Z.MAIN.EUS:v8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    }
  ]
}