{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: HTTP/2 header blocks retained by open streams evade the\n maxSessionMemory limit\n - debian/patches/CVE-2026-56846.patch: charge retained HTTP/2 header memory\n against the session budget. Http2Session::HandleHeadersFrame() used to\n call DecrementCurrentSessionMemory(stream->current_headers_length_) the\n moment the decoded header block was handed up to JS, even though the JS\n objects built from it can stay alive for the whole lifetime of the\n stream, so a peer that opens many streams with large header blocks and\n never lets them complete (initialWindowSize 0, stalled responses) keeps\n unbounded header memory alive while current_session_memory_ reads as near\n zero, maxSessionMemory never trips and no stream is rejected with\n NGHTTP2_ENHANCE_YOUR_CALM. Http2Stream gains a second counter,\n retained_headers_length_; HandleHeadersFrame() moves\n current_headers_length_ into it instead of decrementing the session\n total, and Http2Session::RemoveStream() drains both counters before\n releasing the stream, so header blocks reachable from JS stay accounted\n for exactly as the maxSessionMemory option documents (no upstream\n Node.js 18 fix exists -- 18.x went EOL before disclosure; backported from\n upstream f14d78b9e020, first in v22.23.2, whose v24.x sibling is\n 34ed88a06939 and whose main-branch landing is b7fd13a59a; the doc/api\n wording hunks are dropped)\n - CVE-2026-56846\n * SECURITY UPDATE: HTTP/2 use-after-free when RST_STREAM for a refused stream\n re-enters nghttp2 from inside a receive callback\n - debian/patches/CVE-2026-56848.patch: defer the RST_STREAM purge while\n nghttp2 is in scope. Http2Stream::SubmitRstStream() force-purged pending\n session data through session_->SendPendingData() for every code except\n NGHTTP2_CANCEL, so a refused stream -- onSessionHeaders() answering a\n HEADERS frame for an unknown stream on an already-closed session with\n handle.rstStream(NGHTTP2_REFUSED_STREAM), reached from\n Http2Session::HandleHeadersFrame() inside OnFrameReceive() with\n nghttp2_session_mem_recv() still on the stack -- re-entered\n nghttp2_session_mem_send() inside the active receive operation, where the\n send path can close and free streams the receive is still using\n (heap-use-after-free; triggered remotely by HEADERS for fresh streams\n sent immediately after a GOAWAY with last_stream_id 0). SubmitRstStream()\n now treats NGHTTP2_REFUSED_STREAM while is_in_scope() like the existing\n cancel case: FlushRstStream() only, with the pending data written when\n the enclosing scope unwinds (no upstream Node.js 18 fix exists -- 18.x\n went EOL before disclosure; backported from upstream daa6d25e3dce, first\n in v22.23.2, whose v24.x and v26.x siblings are a77c7f7354c9 and\n 23b94c843ae0; the cosmetic re-indent of the pre-existing\n AddPendingRstStream block is not carried)\n - CVE-2026-56848", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788875504", "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788875504" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_nodejs/debian11/advisories/2026/clsa-2026_1788875504.json" } ], "tracking": { "current_release_date": "2026-09-08T13:52:35Z", "generator": { "date": "2026-09-08T13:52:35Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1788875504", "initial_release_date": "2026-09-08T13:52:35Z", "revision_history": [ { "date": "2026-09-08T13:52:35Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2026-56846, CVE-2026-56848" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 11", "product": { "name": "Debian 11", "product_id": "Debian-11", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-21.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-21.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-21.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-21?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-21.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-21.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-21.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-21?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-21?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.21?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.20?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-20?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-20.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-20.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-20.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-20?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-20.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-20.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-20.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-20?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-17?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-17.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-17.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-17.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-17?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.17?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-17.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-17.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-17.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-17?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-14.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-14.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-14.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-14?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-14.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-14.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-14.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-14?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.14?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-14?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-13.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-13.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-13.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-13?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.13?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-13?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-13.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-13.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-13.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-13?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.12?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-12?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-12.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-12.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-12.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-12?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-12.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-12.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-12.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-12?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-9.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-9.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-9?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-9?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.6?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-9.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-9.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-9?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-5.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-5.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-5.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-5.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-4.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-4.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-4.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-4.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-3.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-3.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-3.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-3.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-1%2Btuxcare.els1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-nodejs@18.20.8-1%2Btuxcare.els1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64", "product": { "name": "alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64", "product_id": "alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-nodejs18-docs@18.20.8-1%2Btuxcare.els1?arch=amd64&os_name=debian&os_version=11" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-21.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-21.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-21.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-21.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-21.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-21.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-20.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-20.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-20.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-20.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-20.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-20.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-17.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-17.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-17.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-17.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-17.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-17.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-14.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-14.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-14.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-14.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-14.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-14.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-13.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-13.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-13.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-13.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-13.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-13.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-12.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-12.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-12.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-12.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-12.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-12.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-9.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-9.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-9.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-9.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-9.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-9.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-5.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-5.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-4.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-4.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-3.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-3.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64" }, "product_reference": "alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-56846", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\r\n\r\nThis vulnerability affects Node.js **24.x** and **22.x**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:alt-nodejs18-docs-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64" ], "known_affected": [ "Debian-11:alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-56846" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases" } ], "release_date": "2026-08-04T01:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-08T13:51:47.331638Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788875504", "product_ids": [ "Debian-11:alt-nodejs18-docs-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788875504" }, { "category": "none_available", "date": "2026-08-04T01:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-56848", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:alt-nodejs18-docs-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64" ], "known_affected": [ "Debian-11:alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-56848" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases" } ], "release_date": "2026-08-04T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-08T13:51:47.331638Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788875504", "product_ids": [ "Debian-11:alt-nodejs18-docs-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-21.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.21.amd64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788875504" }, { "category": "none_available", "date": "2026-08-04T17:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-nodejs18-docs-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-docs-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-nodejs-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-1+tuxcare.els1.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-12.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-13.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-14.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-17.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-20.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-3.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-4.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-5.amd64", "Debian-11:alt-nodejs18-nodejs-devel-0:18.20.8-9.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.1.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.12.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.13.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.14.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.17.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.20.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.3.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.4.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.5.amd64", "Debian-11:alt-nodejs18-npm-0:10.8.2-18.20.8.6.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }