{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 is now available.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.\n\nThis release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 3, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.\n\nSecurity Fix(es):\n\n* httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)\n* jbcs-httpd24-httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)\n* jbcs-httpd24-mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)\n* mod_proxy_ajp.so: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)\n* mod_proxy_ajp.so: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)\n* mod_authn_socache.so: NULL pointer dereference can cause a child process crash (CVE-2026-33007)\n* mod_proxy_ajp.so: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)\n* mod_dav_lock.so: NULL pointer dereference via specially crafted request (CVE-2026-29169)\n* jbcs-httpd24-mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)\n* jbcs-httpd24-httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n* jbcs-httpd24-openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group (CVE-2026-2673)\n* libexpat-2.dll: denial of service via crafted XML input (CVE-2026-45186)\n* openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)\n\nA Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:27201",
        "url": "https://access.redhat.com/errata/RHSA-2026:27201"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_4_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_4_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2379343",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379343"
      },
      {
        "category": "external",
        "summary": "2447327",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447327"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2451094",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
      },
      {
        "category": "external",
        "summary": "2464940",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464940"
      },
      {
        "category": "external",
        "summary": "2464952",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464952"
      },
      {
        "category": "external",
        "summary": "2464953",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464953"
      },
      {
        "category": "external",
        "summary": "2465296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465296"
      },
      {
        "category": "external",
        "summary": "2465299",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465299"
      },
      {
        "category": "external",
        "summary": "2466753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466753"
      },
      {
        "category": "external",
        "summary": "2466913",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466913"
      },
      {
        "category": "external",
        "summary": "2468575",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575"
      },
      {
        "category": "external",
        "summary": "2485371",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485371"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27201.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update",
    "tracking": {
      "current_release_date": "2026-07-19T15:35:59+00:00",
      "generator": {
        "date": "2026-07-19T15:35:59+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:27201",
      "initial_release_date": "2026-06-22T15:13:13+00:00",
      "revision_history": [
        {
          "date": "2026-06-22T15:13:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-22T15:13:13+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-19T15:35:59+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Core Services 2.4.62.SP4",
                "product": {
                  "name": "Red Hat JBoss Core Services 2.4.62.SP4",
                  "product_id": "Red Hat JBoss Core Services 2.4.62.SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_core_services:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Core Services"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-53020",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2025-07-10T18:00:46.989628+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379343"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HTTP Server. This late release of memory after effective lifetime vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS). The vulnerability can lead to resource exhaustion, making the server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mod_http2: Apache HTTP Server: HTTP/2 DoS by Memory Increase",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-53020"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379343",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379343"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53020",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-53020"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53020",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53020"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2025-07-10T16:59:06.340000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "The attack surface can be reduced by disabling HTTP/2 support in Apache.\nFollow the guidance in Red Hat KCS article to:\n- Remove h2 and h2c from the Protocols directive\n- Disable mod_http2 and mod_proxy_http2 modules (if not required)\n\nhttps://access.redhat.com/node/7056356",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mod_http2: Apache HTTP Server: HTTP/2 DoS by Memory Increase"
    },
    {
      "cve": "CVE-2026-2673",
      "cwe": {
        "id": "CWE-325",
        "name": "Missing Cryptographic Step"
      },
      "discovery_date": "2026-03-13T14:01:14.098405+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447327"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A key group selection preference flaw has been discovered in OpenSSL. An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the \"DEFAULT\" keyword. A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client\u0027s initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact of this flaw is limited to the choice of key agreement groups in a specific TLS connection. While a less a preferred key agreement group may allow for a connection to lack post-quantum protection, it is important to know that the connection will still be encrypted with a secure classical cipher and that the degradation of the cipher is limited to the active connection and is not a persistent degradation. Groups which the server operator has disallowed will not be used and it may be the case that the client and server fail to agree upon a key exchange group which would prevent the offending client from constructing a TLS connection.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2673"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447327",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447327"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2673",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2673"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2673",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2673"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f",
          "url": "https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34",
          "url": "https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260313.txt",
          "url": "https://openssl-library.org/news/secadv/20260313.txt"
        }
      ],
      "release_date": "2026-03-13T13:23:00.376000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-28780",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-05-05T22:01:12.666022+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466913"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in mod_proxy_ajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP (Apache JServ Protocol) server, to send a specially crafted message. This message can cause mod_proxy_ajp to write attacker-controlled data beyond a heap-based buffer, potentially leading to arbitrary code execution or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28780"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466913",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466913"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28780",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28780"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28780",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28780"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-05T21:29:41.527000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow"
    },
    {
      "cve": "CVE-2026-29168",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-05T14:01:25.519480+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_md module of httpd. When processing OCSP (Online Certificate Status Protocol) responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_md: unrestricted OCSP response leads to resource exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, the Apache HTTP Server must query an untrusted or compromised OCSP responder, limiting its exposure. Due to this reason, this vulnerability has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_md loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29168"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29168",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29168"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29168",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29168"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-05T13:10:05.656000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_md and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_md: unrestricted OCSP response leads to resource exhaustion"
    },
    {
      "cve": "CVE-2026-29169",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-05-04T15:01:18.611919+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2465296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_dav_lock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: NULL pointer dereference via specially crafted request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue allows an unauthenticated remote attacker to crash the server via a specially crafted request. However, the mod_dav_lock module is obsolete and rarely enabled in modern environments. The only known use-case for the module was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Due to this reason, this vulnerability has been rated with a low severity.\n\nThis flaw only affects configurations with mod_dav_lock loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29169"
        },
        {
          "category": "external",
          "summary": "RHBZ#2465296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29169",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29169"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29169",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29169"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T14:48:29.832000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_dav_lock and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: NULL pointer dereference via specially crafted request"
    },
    {
      "cve": "CVE-2026-31790",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-03-25T02:59:10.179000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451094"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451094",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-31790",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260407.txt",
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        }
      ],
      "release_date": "2026-04-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key"
    },
    {
      "cve": "CVE-2026-33007",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-05-04T15:01:24.989510+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2465299"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_authn_socache module of httpd. This vulnerability allows an unauthenticated remote user to crash a child process due to a NULL pointer dereference when the server is operating in a caching forward proxy configuration.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue allows an unauthenticated remote attacker to cause a crash in a child process. However, the main parent process remains active and functional. Due to this reason, this flaw has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_authn_socache loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33007"
        },
        {
          "category": "external",
          "summary": "RHBZ#2465299",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465299"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33007",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33007"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33007",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33007"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T14:41:27.520000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_authn_socache and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash"
    },
    {
      "cve": "CVE-2026-33857",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-05-04T14:01:10.810459+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464953"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, the Apache HTTP Server must be configured to connect to an untrusted or compromised AJP backend server, limiting its exposure. Due to this reason, this flaw has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_proxy_ajp loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33857"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464953",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464953"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33857",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33857"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33857",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33857"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T13:07:30.753000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_proxy_ajp and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions"
    },
    {
      "cve": "CVE-2026-34032",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "discovery_date": "2026-05-04T14:01:07.000400+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464952"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially leads to memory disclosure and a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, the Apache HTTP Server must be configured to connect to an untrusted or compromised AJP backend server, limiting its exposure. Due to this reason, this flaw has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_proxy_ajp loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34032"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464952",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464952"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34032",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34032"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34032",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34032"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T12:54:54.383000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_proxy_ajp and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check"
    },
    {
      "cve": "CVE-2026-34059",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2026-05-04T13:01:08.557596+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464940"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_proxy_ajp module of httpd. When processing AJP (Apache JServ Protocol) messages, the ajp_parse_data function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially leads to memory disclosure and a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, the Apache HTTP Server must be configured to connect to an untrusted or compromised AJP backend server, limiting its exposure. Due to this reason, this flaw has been rated with a moderate severity.\n\nThis flaw only affects configurations with mod_proxy_ajp loaded and being used. This module can be disabled via the configuration file if its functionality is not being used.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34059"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464940",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464940"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34059"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34059",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34059"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2026-05-04T12:39:42.273000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "Disabling mod_proxy_ajp and restarting httpd will mitigate this flaw.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()"
    },
    {
      "cve": "CVE-2026-45186",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "discovery_date": "2026-05-10T07:00:47.768180+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2468575"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libexpat: denial of service via crafted XML input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to be able to process a specially crafted XML file or input with an application linked to the libexpat library. Also, the only security impact of this flaw is a high consumption of CPU resources that can eventually cause a denial of service. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2468575",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45186"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1216",
          "url": "https://github.com/libexpat/libexpat/pull/1216"
        }
      ],
      "release_date": "2026-05-10T06:36:16.927000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, restrict the maximum size of incoming XML payloads. It is especially critical to limit the decompressed size if the application accepts compressed XML files. Also, consider running the application inside a container or a restricted environment to ensure that the high consumption of CPU resources does not affect the host system.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libexpat: denial of service via crafted XML input"
    },
    {
      "cve": "CVE-2026-49975",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-06-05T06:04:44.009000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2485371"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are then held, leading to a denial of service (DoS) by rendering the server inaccessible.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Apache\u0027s `httpd` HTTP/2 protocol implementation has a denial-of-service (DoS) vulnerability that is rated as Important. An unauthenticated remote attacker can exploit this flaw by combining HPACK compression with flow control manipulation, leading to significant server memory exhaustion and rendering the service inaccessible. This vulnerability exists in default HTTP/2 configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 2.4.62.SP4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49975"
        },
        {
          "category": "external",
          "summary": "RHBZ#2485371",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485371"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-007",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49975",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49975"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49975",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49975"
        },
        {
          "category": "external",
          "summary": "https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb",
          "url": "https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb"
        }
      ],
      "release_date": "2026-06-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-22T15:13:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Core Services 2.4.62.SP4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnghttp2:\n  * libnghttp2-1.68.1-1.hum1 (aarch64, x86_64)\n  * libnghttp2-devel-1.68.1-1.hum1 (aarch64, x86_64)\n  * mingw32-libnghttp2-1.68.1-1.hum1 (aarch64, x86_64)\n  * mingw64-libnghttp2-1.68.1-1.hum1 (aarch64, x86_64)\n  * nghttp2-1.68.1-1.hum1 (aarch64, x86_64)\n  * nghttp2-1.68.1-1.hum1.src (source)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:6190",
        "url": "https://access.redhat.com/errata/RHSA-2026:6190"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27135",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6190.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-19T02:02:01+00:00",
      "generator": {
        "date": "2026-07-19T02:02:01+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:6190",
      "initial_release_date": "2026-03-30T14:45:42+00:00",
      "revision_history": [
        {
          "date": "2026-03-30T14:45:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-18T05:32:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-19T02:02:01+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-main@aarch64",
                "product": {
                  "name": "nghttp2-main@aarch64",
                  "product_id": "nghttp2-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.68.1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-main@x86_64",
                "product": {
                  "name": "nghttp2-main@x86_64",
                  "product_id": "nghttp2-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.68.1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-main@src",
                "product": {
                  "name": "nghttp2-main@src",
                  "product_id": "nghttp2-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.68.1-1.hum1?arch=source\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nghttp2-main@aarch64"
        },
        "product_reference": "nghttp2-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nghttp2-main@src"
        },
        "product_reference": "nghttp2-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nghttp2-main@x86_64"
        },
        "product_reference": "nghttp2-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nghttp2-main@aarch64",
          "Red Hat Hardened Images:nghttp2-main@src",
          "Red Hat Hardened Images:nghttp2-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-30T14:45:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nghttp2-main@aarch64",
            "Red Hat Hardened Images:nghttp2-main@src",
            "Red Hat Hardened Images:nghttp2-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:6190"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nghttp2-main@aarch64",
            "Red Hat Hardened Images:nghttp2-main@src",
            "Red Hat Hardened Images:nghttp2-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nodejs22 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a platform built on Chrome\u0027s JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7080",
        "url": "https://access.redhat.com/errata/RHSA-2026:7080"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2436942",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
      },
      {
        "category": "external",
        "summary": "2441268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
      },
      {
        "category": "external",
        "summary": "2442922",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
      },
      {
        "category": "external",
        "summary": "2447142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
      },
      {
        "category": "external",
        "summary": "2447143",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
      },
      {
        "category": "external",
        "summary": "2447144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
      },
      {
        "category": "external",
        "summary": "2447145",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2453151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7080.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs22 security update",
    "tracking": {
      "current_release_date": "2026-07-19T13:55:12+00:00",
      "generator": {
        "date": "2026-07-19T13:55:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:7080",
      "initial_release_date": "2026-04-08T13:58:58+00:00",
      "revision_history": [
        {
          "date": "2026-04-08T13:58:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-08T13:58:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-19T13:55:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.1.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-devel-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-libs-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-1.el10_1?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-1.el10_1?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-devel-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-libs-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-1.el10_1?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-devel-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-devel-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-libs-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-libs-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
                "product": {
                  "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
                  "product_id": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.7-1.22.22.2.1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_id": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.22.2-1.el10_1?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:22.22.2-1.el10_1.noarch",
                "product": {
                  "name": "nodejs-docs-1:22.22.2-1.el10_1.noarch",
                  "product_id": "nodejs-docs-1:22.22.2-1.el10_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@22.22.2-1.el10_1?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs22-1:22.22.2-1.el10_1.src",
                "product": {
                  "name": "nodejs22-1:22.22.2-1.el10_1.src",
                  "product_id": "nodejs22-1:22.22.2-1.el10_1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22@22.22.2-1.el10_1?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-devel-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:22.22.2-1.el10_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch"
        },
        "product_reference": "nodejs-docs-1:22.22.2-1.el10_1.noarch",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-libs-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64"
        },
        "product_reference": "nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-1:22.22.2-1.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src"
        },
        "product_reference": "nodejs22-1:22.22.2-1.el10_1.src",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        },
        "product_reference": "nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1525",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-12T21:01:33.639277+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447144"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., \"Content-Length\" and \"content-length\"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. A flaw in the undici Node.js HTTP/1.1 client allows for HTTP Request Smuggling or Denial of Service. This can occur in Red Hat products that use undici and process HTTP requests where user-controlled header names are not case-normalized, or headers are passed as flat arrays.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447144",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://cwe.mitre.org/data/definitions/444.html",
          "url": "https://cwe.mitre.org/data/definitions/444.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3556037",
          "url": "https://hackerone.com/reports/3556037"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6",
          "url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"
        }
      ],
      "release_date": "2026-03-12T19:56:55.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers"
    },
    {
      "cve": "CVE-2026-1526",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-12T21:01:25.538271+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447142"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a \"decompression bomb,\" during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447142",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3481206",
          "url": "https://hackerone.com/reports/3481206"
        }
      ],
      "release_date": "2026-03-12T20:08:05.950000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression"
    },
    {
      "cve": "CVE-2026-1528",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:36.954017+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447145"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici\u0027s ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via crafted WebSocket frame with large length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447145",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1528",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3537648",
          "url": "https://hackerone.com/reports/3537648"
        }
      ],
      "release_date": "2026-03-12T20:21:57.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via crafted WebSocket frame with large length"
    },
    {
      "cve": "CVE-2026-2229",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-03-12T21:01:29.187989+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447143"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client\u0027s Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447143",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2229",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc7692",
          "url": "https://datatracker.ietf.org/doc/html/rfc7692"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3487486",
          "url": "https://hackerone.com/reports/3487486"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/api/zlib.html#class-zlibinflateraw",
          "url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"
        }
      ],
      "release_date": "2026-03-12T20:27:05.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter"
    },
    {
      "cve": "CVE-2026-21710",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-03-30T20:01:21.196629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
        }
      ],
      "release_date": "2026-03-30T19:07:28.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header"
    },
    {
      "cve": "CVE-2026-25547",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-02-04T22:01:11.784120+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436942"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion component. This denial of service (DoS) vulnerability allows a remote attacker to provide specially crafted input containing repeated numeric brace ranges. This input causes the library to attempt an unbounded expansion, consuming excessive CPU and memory resources. This can lead to a system crash, impacting the availability of the service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436942",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2",
          "url": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2"
        }
      ],
      "release_date": "2026-02-04T21:51:17.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion"
    },
    {
      "cve": "CVE-2026-26996",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-20T04:01:11.896063+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
          "url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
        }
      ],
      "release_date": "2026-02-20T03:05:21.105000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27904",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-26T02:01:23.004531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442922"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
          "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442922",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "release_date": "2026-02-26T01:07:42.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:58:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7080"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-devel-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-docs-1:22.22.2-1.el10_1.noarch",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-full-i18n-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-libs-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-1:22.22.2-1.el10_1.src",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debuginfo-1:22.22.2-1.el10_1.x86_64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.aarch64",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.ppc64le",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.s390x",
            "AppStream-10.1.Z:nodejs22-debugsource-1:22.22.2-1.el10_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    }
  ]
}