Veille CVE

Vendredi 26 juin 2026

3 CVE sur 9

Critique 1 Élevée 3 Moyenne 3 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Nodejs node.js » ✕
  1. CVE-2026-48933 7.5 Élevée

    nodejs node · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8

    A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

  2. CVE-2026-48619 7.5 Élevée

    nodejs node · Nodejs node.js

    A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

  3. CVE-2026-48615 7.5 Élevée

    nodejs node · Nodejs node.js

    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.