Description
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nghttp2 | nghttp2 | < 1.68.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nghttp2 | 1.68.1-1 | — |
| Debian 13 | nghttp2 | 1.64.0-1.1+deb13u1 | — |
| Debian 12 | nghttp2 | 1.52.0-1+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | nghttp2 | 1.68.0-2ubuntu0.1 | — |
| Ubuntu 25.10 | nghttp2 | 1.64.0-1.1ubuntu1.1 | — |
| Ubuntu 24.04 LTS | nghttp2 | 1.59.0-1ubuntu0.3 | — |
| Ubuntu 22.04 LTS | nghttp2 | 1.43.0-1ubuntu0.3 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | nghttp2 | 1.40.0-1ubuntu0.3+esm1 | — |
| Ubuntu Pro 18.04 LTS | nghttp2 | 1.30.0-1ubuntu1+esm3 | — |
| Ubuntu Pro 16.04 LTS | nghttp2 | 1.7.1-1ubuntu0.1~esm3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nghttp2 +2 | 1.64.0-2.el10_1.1 | RHSA-2026:7666 |
| RHEL 10 | nodejs +5 | 1:22.22.2-1.el10_1 | RHSA-2026:7080 |
| RHEL 10 | nodejs-npm | 1:10.9.7-1.22.22.2.1.el10_1 | RHSA-2026:7080 |
| RHEL 10 | nodejs24 +4 | 1:24.14.1-2.el10_1 | RHSA-2026:7675 |
| RHEL 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 | RHSA-2026:7675 |
| RHEL 9 | nghttp2 +2 | 1.43.0-6.el9_7.1 | RHSA-2026:7668 |
| RHEL 9 | nodejs +3 | 1:20.20.2-1.module+el9.7.0+24193+41b7b572 | RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | nodejs-libs | 1:22.22.2-1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | npm | 1:10.8.2-1.20.20.2.1.module+el9.7.0+24193+41b7b572 | RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7302 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b | RHSA-2026:7350 |
| RHEL 8 | nghttp2 +2 | 1.33.0-6.el8_10.2 | RHSA-2026:7667 |
| RHEL 8 | nodejs +3 | 1:20.20.2-1.module+el8.10.0+24197+1602b452 | RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | nodejs-libs | 1:22.22.2-1.module+el8.10.0+24148+847b6786 | RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+23521+490ebfde | RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24148+847b6786 | RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | npm | 1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452 | RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75 | RHSA-2026:7670 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | nghttp2 +2 | 1.64.0-2.el10_0.1 | RHSA-2026:8868 |
| RHEL 10.0 EUS | nodejs +5 | 1:22.22.2-2.el10_0 | RHSA-2026:7310 |
| RHEL 10.0 EUS | nodejs-npm | 1:10.9.7-1.22.22.2.2.el10_0 | RHSA-2026:7310 |
| RHEL 9.6 EUS | nghttp2 +2 | 1.43.0-6.el9_6.1 | RHSA-2026:8548 |
| RHEL 9.6 EUS | nodejs +3 | 1:20.20.2-2.module+el9.6.0+24220+c44c288d | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-libs | 1:22.22.2-1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.0.1-1.module+el9.6.0+23146+be9976bd | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23146+be9976bd | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | npm | 1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
| RHEL 9.4 EUS | nghttp2 +2 | 1.43.0-5.el9_4.4 | RHSA-2026:8547 |
| RHEL 9.4 EUS | nodejs +3 | 1:20.20.2-2.module+el9.4.0+24216+64c58546 | RHSA-2026:9711 |
| RHEL 9.4 EUS | nodejs-nodemon | 3.0.1-1.module+el9.3.0.z+20478+84a9f781 | RHSA-2026:9711 |
| RHEL 9.4 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.3.0+19518+63aad52d | RHSA-2026:9711 |
| RHEL 9.4 EUS | npm | 1:10.8.2-1.20.20.2.2.module+el9.4.0+24216+64c58546 | RHSA-2026:9711 |
| RHEL 9.2 E4S | nghttp2 +1 | 1.43.0-5.el9_2.4 | RHSA-2026:8545 |
| RHEL 9.0 E4S | nghttp2 +1 | 1.43.0-5.el9_0.4 | RHSA-2026:8546 |
| RHEL 8.8 TUS | nghttp2 +1 | 1.33.0-5.el8_8.2 | RHSA-2026:8540 |
| RHEL 8.8 E4S | nghttp2 +1 | 1.33.0-5.el8_8.2 | RHSA-2026:8540 |
| RHEL 8.6 TUS | nghttp2 +1 | 1.33.0-4.el8_6.3 | RHSA-2026:8538 |
| RHEL 8.6 E4S | nghttp2 +1 | 1.33.0-4.el8_6.3 | RHSA-2026:8538 |
| RHEL 8.6 AUS | nghttp2 +1 | 1.33.0-4.el8_6.3 | RHSA-2026:8538 |
| RHEL 8.4 EUS Long Life | nghttp2 +1 | 1.33.0-4.el8_4.3 | RHSA-2026:8539 |
| RHEL 8.4 AUS | nghttp2 +1 | 1.33.0-4.el8_4.3 | RHSA-2026:8539 |
| RHEL 8.2 AUS | nghttp2 +1 | 1.33.0-3.el8_2.4 | RHSA-2026:8541 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.62-13.el7jbcs | RHSA-2026:27200 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_http2 | 2.0.29-10.el7jbcs | RHSA-2026:27200 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_md | 1:2.4.28-16.el7jbcs | RHSA-2026:27200 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.62-13.el7jbcs | RHSA-2026:27200 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-nghttp2 +1 | 1.64.0-3.el7jbcs | RHSA-2026:27200 |
| Red Hat Hardened Images 1 | nghttp2 +4 | 1.68.1-1.hum1 | RHSA-2026:77939, RHSA-2026:6190 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nghttp2 +2 | 1.64.0-2.el10_1.1 | ALSA-2026:7666 |
| AlmaLinux 10 | nodejs-docs | 1:22.22.2-1.el10_1 | ALSA-2026:7080 |
| AlmaLinux 10 | nodejs24-docs | 1:24.14.1-2.el10_1 | ALSA-2026:7675 |
| AlmaLinux 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 | ALSA-2026:7675 |
| AlmaLinux 9 | nghttp2 +2 | 1.43.0-6.el9_7.1 | ALSA-2026:7668 |
| AlmaLinux 9 | nodejs | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-docs +2 | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-libs | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.5.0+125+8dc38870 | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+198+8bf605ba | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | npm | 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux 8 | nghttp2 +2 | 1.33.0-6.el8_10.2 | ALSA-2026:7667 |
| AlmaLinux 8 | nodejs +3 | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-libs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3982+85c136aa | ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | npm | 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nghttp2 | 1.64.0-2.el10_1.1 | RLSA-2026:7666 |
| Rocky Linux 10 | nodejs22 | 1:22.22.2-1.el10_1 | RLSA-2026:7080 |
| Rocky Linux 10 | nodejs24 | 1:24.14.1-2.el10_1 | RLSA-2026:7675 |
| Rocky Linux 9 | nghttp2 | 1.43.0-6.el9_7.1 | RLSA-2026:7668 |
| Rocky Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:7896, RLSA-2026:7350, RLSA-2026:7302 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7896, RLSA-2026:7350, RLSA-2026:7302 |
| Rocky Linux 8 | nghttp2 | 1.33.0-6.el8_10.2 | RLSA-2026:7667 |
| Rocky Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:8339, RLSA-2026:7670, RLSA-2026:7123 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:8339, RLSA-2026:7670, RLSA-2026:7123 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | nghttp2 | 1.40.0-150600.25.5.1 | SUSE-SU-2026:1350-1, SUSE-SU-2026:1074-1 |
| SLES 15 SP7 | nodejs22 | 22.23.0-150700.3.12.1 | SUSE-SU-2026:2695-1 |
| SLES 15 SP7 | nodejs24 | 24.17.0-150700.15.11.1 | SUSE-SU-2026:2633-1 |
| SLES 15 SP6 | nghttp2 | 1.40.0-150600.25.5.1 | SUSE-SU-2026:1350-1 |
| SLES 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES 15 SP6 | nodejs22 | 22.23.0-150600.13.18.1 | SUSE-SU-2026:2647-1 |
| SLES 15 SP5 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLES 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLES 15 SP4 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLES 15 SP4 | nodejs16 | 16.20.2-150400.3.42.1 | SUSE-SU-2026:4355-1 |
| SLES 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES 12 SP5 | nghttp2 | 1.39.2-3.23.1 | SUSE-SU-2026:1056-1 |
| SLES 12 SP5 | nodejs18 | 18.20.8-8.44.1 | SUSE-SU-2026:4248-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | nghttp2 | 1.64.0-160000.3.1 | SUSE-SU-2026:20925-1 |
| SLES for SAP 16.0 | nodejs22 | 22.23.0-160000.1.1 | SUSE-SU-2026:22368-1 |
| SLES for SAP 16.0 | nodejs24 | 24.18.0-160000.1.1 | SUSE-SU-2026:22565-1 |
| SLES for SAP 15 SP6 | nghttp2 | 1.40.0-150600.25.5.1 | SUSE-SU-2026:1350-1 |
| SLES for SAP 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES for SAP 15 SP6 | nodejs22 | 22.23.0-150600.13.18.1 | SUSE-SU-2026:2647-1 |
| SLES for SAP 15 SP5 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLES for SAP 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES for SAP 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLES for SAP 15 SP4 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLES for SAP 15 SP4 | nodejs16 | 16.20.2-150400.3.42.1 | SUSE-SU-2026:4355-1 |
| SLES for SAP 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES 16.0 | nghttp2 | 1.64.0-160000.3.1 | SUSE-SU-2026:20925-1 |
| SLES 16.0 | nodejs22 | 22.23.0-160000.1.1 | SUSE-SU-2026:22368-1 |
| SLES 16.0 | nodejs24 | 24.18.0-160000.1.1 | SUSE-SU-2026:22565-1 |
| SLE Micro 6.2 | nghttp2 | 1.64.0-160000.3.1 | SUSE-SU-2026:20833-1 |
| SLE Micro 6.1 | nghttp2 | 1.52.0-slfo.1.1_2.1 | SUSE-SU-2026:20950-1 |
| SLE Micro 6.0 | cockpit | 309-9.1 | SUSE-SU-2026:20950-1 |
| SLE Micro 6.0 | nghttp2 | 1.52.0-6.1 | SUSE-SU-2026:20870-1 |
| SLE Micro 5.5 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLE Micro 5.4 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLE Micro 5.3 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLE Micro 5.2 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLE HPC 15 SP5 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLE HPC 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLE HPC 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLE HPC 15 SP4 | nghttp2 | 1.40.0-150200.22.1 | SUSE-SU-2026:1247-1 |
| SLE HPC 15 SP4 | nodejs16 | 16.20.2-150400.3.42.1 | SUSE-SU-2026:4355-1 |
| SLE HPC 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nghttp2 | 1.68.1-1.1 | openSUSE-SU-2026:10437-1 |
| openSUSE Tumbleweed | nodejs24 | 24.17.0-1.1 | openSUSE-SU-2026:11121-1 |
| openSUSE Leap 16.0 | nghttp2 | 1.64.0-160000.3.1 | openSUSE-SU-2026:20413-1 |
| openSUSE Leap 16.0 | nodejs22 | 22.23.0-160000.1.1 | openSUSE-SU-2026:21058-1 |
| openSUSE Leap 16.0 | nodejs24 | 24.18.0-160000.1.1 | openSUSE-SU-2026:21236-1 |
| openSUSE Leap 15.6 | nghttp2 +1 | 1.40.0-150600.25.5.1 | SUSE-SU-2026:1350-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nghttp2 | 1.68.1-r0 | — |
| Alpine v3.23 | nghttp2 | 1.68.1 | — |
| Alpine v3.22 | nghttp2 | 1.68.1 | — |
| Alpine v3.21 | nghttp2 | 1.68.1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nghttp2 +2 | 1.59.0-3.amzn2023.0.2 | ALAS2023-2026-1542 |
| Amazon Linux 2023 | nodejs22 +4 | 1:22.22.2-1.amzn2023.0.3 | ALAS2023-2026-1648 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.7-1.22.22.2.1.amzn2023.0.3 | ALAS2023-2026-1648 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.15.0-1.amzn2023.0.2 | ALAS2023-2026-1647 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.12.1-1.24.15.0.1.amzn2023.0.2 | ALAS2023-2026-1647 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.amzn2023.0.3 | ALAS2023-2026-1648 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.15.0.1.amzn2023.0.2 | ALAS2023-2026-1647 |
| Amazon Linux 2 | nghttp2 +2 | 1.41.0-1.amzn2.0.6 | ALAS2-2026-3232 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.30.3-13 | — |
| Azure Linux 3 | nghttp2 | 1.61.0-3 | — |
| Azure Linux 3 | nodejs | 20.14.0-14 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nghttp2 +2 | 1.64.0-2.el10_1.1 | ELSA-2026-7666 |
| Oracle Linux 10 | nodejs +4 | 1:22.22.2-1.el10_1 | ELSA-2026-7080 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.7-1.22.22.2.1.el10_1 | ELSA-2026-7080 |
| Oracle Linux 10 | nodejs24 +4 | 1:24.14.1-2.0.2.el10_1 | ELSA-2026-7675 |
| Oracle Linux 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.0.2.el10_1 | ELSA-2026-7675 |
| Oracle Linux 9 | nghttp2 +2 | 1.43.0-6.el9_7.1 | ELSA-2026-7668 |
| Oracle Linux 9 | nodejs +3 | 1:20.20.2-1.module+el9.7.0+90874+6d84790f | ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-libs | 1:22.22.2-1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.7.0+90866+5a953a4c | ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | npm | 1:10.8.2-1.20.20.2.1.module+el9.7.0+90874+6d84790f | ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7302 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+90866+5a953a4c | ELSA-2026-7350 |
| Oracle Linux 8 | nghttp2 +2 | 1.33.0-6.el8_10.2 | ELSA-2026-7667 |
| Oracle Linux 8 | nodejs +3 | 1:20.20.2-1.module+el8.10.0+90878+0d41f8c0 | ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-libs | 1:22.22.2-1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+90743+b61054a8 | ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.10.0+90865+d647ef3a | ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | npm | 1:10.8.2-1.20.20.2.1.module+el8.10.0+90878+0d41f8c0 | ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+90873+35652ecc | ELSA-2026-7670 |
Advisories 50
- WID-SEC-2026-0775 nghttp2: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 11, 2026
- SSA-457936 SSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7 Siemens ProductCERT · Nov 10, 2026
- ALSA-2026:7666 Important: nghttp2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7896 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7350 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7668 Important: nghttp2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7675 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7080 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7670 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7123 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7667 Important: nghttp2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:8339 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- ICSA-26-295-11 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP CISA ICS & IT advisories · Oct 22, 2026
- RHSA-2026:9711 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9874 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:8339 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7983 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7896 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7675 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7670 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7350 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7302 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7310 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7123 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7080 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:8868 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8548 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8546 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8547 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8545 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8539 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8540 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8541 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8538 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:77939 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7668 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7667 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7666 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:6190 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:27200 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- SSA-019113 SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 Siemens ProductCERT · Oct 13, 2026
- SUSE-SU-2026:4355-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:4261-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Sep 18, 2026
- SUSE-SU-2026:4248-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Sep 18, 2026
- WID-SEC-2026-2253 IBM Security Verify Access: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- SUSE-SU-2026:3929-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3930-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- VDE-2026-088 METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 CERT@VDE · Sep 10, 2026
- WID-SEC-2026-1666 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 28, 2026