{"schema":"vulnpedia.research/1","cve":"CVE-2026-105481","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","tags":["vendor-reference"],"source":"mitre","sourceId":"hackerone","modified":"2026-10-23T16:15:05.837Z","origins":[{"source":"mitre","sourceId":"hackerone","modified":"2026-10-23T16:15:05.837Z","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"source":"nvd","sourceId":"CVE-2026-105481","modified":"2026-10-23T19:42:24.553","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105481","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-105481"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560019","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560019"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105481","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-105481"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105481","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105481"}]},{"source":"euvd","sourceId":"EUVD-2026-109106","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109106","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-109106","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109106"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/CompleTetech-Security/node-cve-2026-105481-check","source":"poc-in-github","sourceId":"CVE-2026-105481","description":"Offline Node.js evidence checker for CVE-2026-105481: HTTP keep-alive premature-response acceptance. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.","modified":"2026-10-26T05:05:52Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-105481","url":"https://github.com/CompleTetech-Security/node-cve-2026-105481-check"},{"source":"poc-in-github","sourceId":"CVE-2026-105481","modified":"2026-10-26T05:05:52Z","url":"https://github.com/CompleTetech-Security/node-cve-2026-105481-check"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_10:nodejs","product":"nodejs as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_10:nodejs-docs","product":"nodejs-docs as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-docs","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_10:nodejs-npm","product":"nodejs-npm as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-npm","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_10:nodejs24","product":"nodejs24 as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_10:nodejs24-full-i18n","product":"nodejs24-full-i18n as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs24-full-i18n","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_10:nodejs24-npm","product":"nodejs24-npm as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs24-npm","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_10:nodejs26.src","product":"nodejs26.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs26?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs-docs::nodejs:22","product":"nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs-full-i18n::nodejs:22","product":"nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs-libs::nodejs:24","product":"nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs-nodemon.src::nodejs:24","product":"nodejs-nodemon.src (nodejs:24) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-nodemon?arch=src&rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs-nodemon::nodejs:24","product":"nodejs-nodemon (nodejs:24) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-nodemon?rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs-packaging.src::nodejs:22","product":"nodejs-packaging.src (nodejs:22) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-packaging?arch=src&rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs-packaging::nodejs:22","product":"nodejs-packaging (nodejs:22) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-packaging?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs.src::nodejs:24","product":"nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:nodejs::nodejs:24","product":"nodejs (nodejs:24) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs?rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:npm::nodejs:24","product":"npm (nodejs:24) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/npm?rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_8:v8-13.6-devel::nodejs:22","product":"v8-13.6-devel (nodejs:22) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/v8-13.6-devel?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_9:nodejs-docs::nodejs:22","product":"nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_9:nodejs-full-i18n::nodejs:22","product":"nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_9:nodejs-full-i18n::nodejs:26","product":"nodejs-full-i18n (nodejs:26) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:26","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_9:nodejs-libs::nodejs:24","product":"nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_9:nodejs.src::nodejs:24","product":"nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_9:nodejs::nodejs:22","product":"nodejs (nodejs:22) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/nodejs?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_9:npm::nodejs:22","product":"npm (nodejs:22) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/npm?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_enterprise_linux_9:npm::nodejs:26","product":"npm (nodejs:26) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/npm?rpmmod=nodejs:26","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_hardened_images:hi/nodejs","product":"hi/nodejs as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/nodejs?repository_url=registry.redhat.io/hi/nodejs","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_hardened_images:nodejs20.src","product":"nodejs20.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs20?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_hardened_images:nodejs22.src","product":"nodejs22.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs22?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_hardened_images:nodejs24.src","product":"nodejs24.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs24?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_hardened_images:nodejs25.src","product":"nodejs25.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs25?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]},{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json","productId":"red_hat_hardened_images:nodejs26.src","product":"nodejs26.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs26?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-105481","modified":"2026-10-26T11:03:07+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105481.json"}]}],"vendorCoverage":{"total":67,"shown":32,"omitted":35,"source":"redhat"}}