ghcr.io/ubi-micro-dev/ubi8-micro-dev-nodejs-22:latest

With RPM updates as of

Show kernel-headers

ID	Age	Component	Trivy Severity	Grype Severity	Red Hat Severity	ubi-micro-dev Opinion
CVE-2026-1526	5	nodejs nodejs-libs npm	High	High	Important
CVE-2026-1528	5	nodejs nodejs-libs npm	High	High	Important
CVE-2026-2229	5	nodejs nodejs-libs npm	High	High	Important
CVE-2023-0466	1085	openssl openssl-libs	Medium	Medium	Moderate
CVE-2025-7458	231	nodejs nodejs-libs npm	Medium	Medium	Moderate
CVE-2025-29087	344	nodejs nodejs-libs npm	Medium	Medium	Moderate
CVE-2025-62408	99	nodejs nodejs-libs npm	Medium	Medium	Moderate
CVE-2025-64118	138	nodejs nodejs-libs npm	Medium	Medium	Moderate
CVE-2025-64756	120	glob nodejs nodejs-libs npm	Medium	High	Important
CVE-2026-1525	5	nodejs nodejs-libs npm	Medium	Medium	Moderate
CVE-2026-1527	5	nodejs nodejs-libs npm	Medium	Medium	Moderate
CVE-2026-2581	5	nodejs nodejs-libs npm	Medium	Medium	Moderate
CVE-2026-25547	41	nodejs nodejs-libs npm	Medium	Medium	Moderate
CVE-2026-26996	27	minimatch nodejs nodejs-libs npm	Medium	High	Moderate
CVE-2026-27903	19	minimatch nodejs nodejs-libs npm	Medium	High	Moderate
CVE-2026-27904	19	minimatch nodejs nodejs-libs npm	Medium	High	Moderate
CVE-2026-31802	7	nodejs nodejs-libs npm tar	Medium	High	Moderate
CVE-2018-19211	2682	ncurses-libs	Low	Low	Low	False Positive
CVE-2018-20657	2631	libgcc libstdc++	Low	Low	Low
CVE-2018-1000654	2766	libtasn1	Low	Low	Low	False Positive
CVE-2019-14250	2429	libgcc libstdc++	Low	Low	Low
CVE-2020-19185	938	ncurses-libs	Low	Low	Low	False Positive
CVE-2020-19186	938	ncurses-libs	Low	Low	Low	False Positive
CVE-2020-19187	938	ncurses-libs	Low	Low	Low	False Positive
CVE-2020-19188	938	ncurses-libs	Low	Low	Low	False Positive
CVE-2020-19189	938	ncurses-libs	Low	Low	Low	False Positive
CVE-2020-19190	938	ncurses-libs	Low	Low	Low	False Positive
CVE-2021-39537	1639	ncurses-libs	Low	Low	Low	False Positive
CVE-2022-27943	1452	libgcc libstdc++	Low	Low	Low	False Positive
CVE-2022-41409	973	pcre2	Low	Low	Low	False Positive
CVE-2023-0464	1091	openssl openssl-libs	Low	Low	Low
CVE-2023-0465	1085	openssl openssl-libs	Low	Low	Low
CVE-2023-2650	1022	openssl openssl-libs	Low	Medium	Moderate
CVE-2023-50495	826	ncurses-libs	Low	Low	Low	False Positive
CVE-2024-0727	781	openssl openssl-libs	Low	Low	Low
CVE-2024-2511	708	openssl openssl-libs	Low	Low	Low
CVE-2024-4741	489	openssl openssl-libs	Low	Low	Low
CVE-2024-13176	421	openssl openssl-libs	Low	Low	Low
CVE-2024-41996	569	openssl openssl-libs	Low	Low	Low
CVE-2025-5889	281	nodejs nodejs-libs npm	Low	Low	Low
CVE-2025-13151	69	libtasn1	Low	Low	Low
CVE-2025-15468	49	openssl openssl-libs	Low	Low	Low
CVE-2025-15469	49	openssl openssl-libs	Low	Low	Low
CVE-2025-47279	306	nodejs nodejs-libs npm	Low	Low	Low
CVE-2025-66199	49	openssl openssl-libs	Low	Low	Low
CVE-2025-68160	49	openssl openssl-libs	Low	Low	Low
CVE-2025-69418	49	openssl openssl-libs	Low	Low	Low
CVE-2025-69420	49	openssl openssl-libs	Low	Low	Low
CVE-2025-69421	49	openssl openssl-libs	Low	Low	Low
CVE-2025-70873	5	nodejs nodejs-libs npm	Low	Low	Low
CVE-2026-2673	4	openssl openssl-libs	Low	Low	Low
CVE-2026-22036	62	nodejs nodejs-libs npm	Low	Low	Low
CVE-2026-22795	49	openssl openssl-libs	Low	Low	Low
CVE-2026-22796	49	openssl openssl-libs	Low	Low	Low
CVE-2026-27171	28	zlib	Low	Low	Low
CVE-2026-24842	48	tar		High	Important
CVE-2026-29786	13	tar		High	Important
CVE-2026-26960	28	tar		High	Moderate
CVE-2026-23950	56	tar		High	Important
CVE-2026-23745	60	tar		High	Important
CVE-2026-24001	62	diff		Low	Important

Security Advisory: CVE-2026-27903

Description:

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.

Locations:

/usr/lib/node_modules/npm/node_modules/minimatch/package.json
nodejs-1:22.22.0-1.module+el8.10.0+23904+2c92f862
nodejs-libs-1:22.22.0-1.module+el8.10.0+23904+2c92f862
npm-1:10.9.4-1.22.22.0.1.module+el8.10.0+23904+2c92f862

References:

Security Advisory: CVE-2023-2650

Description:

Issue summary: Processing some specially crafted ASN.1 object identifiers or
data containing them may be very slow.
Impact summary: Applications that use OBJ_obj2txt() directly, or use any of
the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message
size limit may experience notable to very long delays when processing those
messages, which may lead to a Denial of Service.
An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -
most of which have no size limit. OBJ_obj2txt() may be used to translate
an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL
type ASN1_OBJECT) to its canonical numeric text form, which are the
sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by
periods.
When one of the sub-identifiers in the OBJECT IDENTIFIER is very large
(these are sizes that are seen as absurdly large, taking up tens or hundreds
of KiBs), the translation to a decimal number in text may take a very long
time. The time complexity is O(n^2) with 'n' being the size of the
sub-identifiers in bytes (*).
With OpenSSL 3.0, support to fetch cryptographic algorithms using names /
identifiers in string form was introduced. This includes using OBJECT
IDENTIFIERs in canonical numeric text form as identifiers for fetching
algorithms.
Such OBJECT IDENTIFIERs may be received through the ASN.1 structure
AlgorithmIdentifier, which is commonly used in multiple protocols to specify
what cryptographic algorithm should be used to sign or verify, encrypt or
decrypt, or digest passed data.
Applications that call OBJ_obj2txt() directly with untrusted data are
affected, with any version of OpenSSL. If the use is for the mere purpose
of display, the severity is considered low.
In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,
CMS, CMP/CRMF or TS. It also impacts anything that processes X.509
certificates, including simple things like verifying its signature.
The impact on TLS is relatively low, because all versions of OpenSSL have a
100KiB limit on the peer's certificate chain. Additionally, this only
impacts clients, or servers that have explicitly enabled client
authentication.
In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,
such as X.509 certificates. This is assumed to not happen in such a way
that it would cause a Denial of Service, so these versions are considered
not affected by this issue in such a way that it would be cause for concern,
and the severity is therefore considered low.

Locations:

openssl-1:1.1.1k-15.el8_6
openssl-libs-1:1.1.1k-15.el8_6

References:

Security Advisory: CVE-2026-23950

Description:

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.

Locations:

/usr/lib/node_modules/npm/node_modules/cacache/node_modules/tar/package.json
/usr/lib/node_modules/npm/node_modules/node-gyp/node_modules/tar/package.json
/usr/lib/node_modules/npm/node_modules/tar/package.json

References:

Security Advisory: CVE-2026-24001

Description:

jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\r`, `\u2028`, or `\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its "leading garbage"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\r`, `\u2028`, or `\u2029`.

Locations:

/usr/lib/node_modules/npm/node_modules/diff/package.json