[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-56848":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":20,"aliases":21,"duplicate_of":9,"upstream":29,"downstream":30,"duplicates":79,"related":80,"reserved_at":9,"published_at":96,"modified_at":97,"state":98,"summary":99,"references_raw":108,"kevs":139,"epss":140,"epss_history":143,"metrics":281,"affected":295},"CVE-2026-56848","A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-416","Use After Free","The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","weakness","Stable","Variant","High",[],[],[22,23,24,25,26,27,28],"ALPINE-CVE-2026-56848","UBUNTU-CVE-2026-56848","DEBIAN-CVE-2026-56848","CGA-7j82-7jwr-pm55","CGA-9wcv-42q2-w2qx","CGA-vpg2-73gr-45hm","CGA-w75j-wfvv-3mc6",[],[31,33,35,37,39,41,43,45,47,49,51,53,55,57,59,61,63,65,67,69,71,73,75,77],{"_key":32},"SUSE-SU-2026:3520-1",{"_key":34},"SUSE-SU-2026:3521-1",{"_key":36},"SUSE-SU-2026:3557-1",{"_key":38},"OPENSUSE-SU-2026:11439-1",{"_key":40},"OPENSUSE-SU-2026:11440-1",{"_key":42},"OPENSUSE-SU-2026:21545-1",{"_key":44},"OPENSUSE-SU-2026:21546-1",{"_key":46},"SUSE-SU-2026:23130-1",{"_key":48},"SUSE-SU-2026:23131-1",{"_key":50},"SUSE-SU-2026:23154-1",{"_key":52},"SUSE-SU-2026:23155-1",{"_key":54},"MGASA-2026-0359",{"_key":56},"RHSA-2026:61376",{"_key":58},"RHSA-2026:61377",{"_key":60},"RHSA-2026:61383",{"_key":62},"RHSA-2026:61386",{"_key":64},"RHSA-2026:62219",{"_key":66},"RHSA-2026:62583",{"_key":68},"SUSE-SU-2026:3929-1",{"_key":70},"SUSE-SU-2026:3930-1",{"_key":72},"SUSE-SU-2026:4248-1",{"_key":74},"SUSE-SU-2026:4261-1",{"_key":76},"RHSA-2026:62416",{"_key":78},"RHSA-2026:64817",[],[81,82,83,84,85,86,87,88,89,90,91,92,93,94,95],{"_key":32},{"_key":34},{"_key":36},{"_key":38},{"_key":40},{"_key":42},{"_key":44},{"_key":46},{"_key":48},{"_key":50},{"_key":52},{"_key":68},{"_key":70},{"_key":72},{"_key":74},"2026-08-04T15:57:24.399Z","2026-08-04T17:36:14.044Z","Awaiting Analysis",{"cisa_kev":100,"cisa_ransomware":100,"cisa_vendor":9,"epss_severity":101,"epss_score":102,"severity":103,"severity_score":104,"severity_version":105,"severity_source":106,"severity_vector":107,"severity_status":98},false,"low",0.0049,"high",7.5,"v3.0","cve.org","CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[109,114,120,126,130,134],{"url":110,"sources":111,"tags":113},"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",[106,112],"nvd",[],{"url":115,"sources":116,"tags":118},"https://security.alpinelinux.org/vuln/CVE-2026-56848",[117],"osv_alpine",[119],"Advisory",{"url":121,"sources":122,"tags":124},"https://ubuntu.com/security/CVE-2026-56848",[123],"osv_ubuntu",[125],"REPORT",{"url":127,"sources":128,"tags":129},"https://www.cve.org/CVERecord?id=CVE-2026-56848",[123],[125],{"url":131,"sources":132,"tags":133},"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-re-entrant-send-can-cause-heap-use-after-free-cve-2026-56848---high",[123],[125],{"url":135,"sources":136,"tags":138},"https://security-tracker.debian.org/tracker/CVE-2026-56848",[137],"osv_debian",[119],[],{"date":141,"score":102,"percentile":142},"2026-09-19",0.41209,[144,148,151,154,157,160,164,167,170,173,176,179,182,184,187,190,193,196,199,202,205,208,211,214,217,220,223,226,229,232,235,238,241,244,247,250,253,256,259,262,265,268,271,274,277,280],{"date":145,"score":146,"percentile":147},"2026-08-05",0.00548,0.42823,{"date":149,"score":146,"percentile":150},"2026-08-06",0.42858,{"date":152,"score":146,"percentile":153},"2026-08-07",0.42906,{"date":155,"score":146,"percentile":156},"2026-08-08",0.42912,{"date":158,"score":146,"percentile":159},"2026-08-09",0.42898,{"date":161,"score":162,"percentile":163},"2026-08-10",0.00623,0.46538,{"date":165,"score":162,"percentile":166},"2026-08-11",0.46619,{"date":168,"score":162,"percentile":169},"2026-08-12",0.46713,{"date":171,"score":162,"percentile":172},"2026-08-13",0.46757,{"date":174,"score":162,"percentile":175},"2026-08-14",0.46828,{"date":177,"score":162,"percentile":178},"2026-08-15",0.46944,{"date":180,"score":162,"percentile":181},"2026-08-16",0.46967,{"date":183,"score":162,"percentile":178},"2026-08-17",{"date":185,"score":162,"percentile":186},"2026-08-18",0.46968,{"date":188,"score":162,"percentile":189},"2026-08-19",0.47168,{"date":191,"score":162,"percentile":192},"2026-08-20",0.47231,{"date":194,"score":162,"percentile":195},"2026-08-21",0.47279,{"date":197,"score":162,"percentile":198},"2026-08-22",0.47298,{"date":200,"score":162,"percentile":201},"2026-08-23",0.47022,{"date":203,"score":102,"percentile":204},"2026-08-24",0.39905,{"date":206,"score":102,"percentile":207},"2026-08-25",0.39941,{"date":209,"score":102,"percentile":210},"2026-08-26",0.40038,{"date":212,"score":102,"percentile":213},"2026-08-27",0.40082,{"date":215,"score":102,"percentile":216},"2026-08-28",0.40021,{"date":218,"score":102,"percentile":219},"2026-08-29",0.40058,{"date":221,"score":102,"percentile":222},"2026-08-30",0.40174,{"date":224,"score":102,"percentile":225},"2026-08-31",0.40184,{"date":227,"score":102,"percentile":228},"2026-09-01",0.40213,{"date":230,"score":102,"percentile":231},"2026-09-02",0.40263,{"date":233,"score":102,"percentile":234},"2026-09-03",0.40289,{"date":236,"score":102,"percentile":237},"2026-09-04",0.40331,{"date":239,"score":102,"percentile":240},"2026-09-05",0.40279,{"date":242,"score":102,"percentile":243},"2026-09-06",0.40402,{"date":245,"score":102,"percentile":246},"2026-09-07",0.40407,{"date":248,"score":102,"percentile":249},"2026-09-08",0.40427,{"date":251,"score":102,"percentile":252},"2026-09-09",0.40579,{"date":254,"score":102,"percentile":255},"2026-09-10",0.40602,{"date":257,"score":102,"percentile":258},"2026-09-11",0.40632,{"date":260,"score":102,"percentile":261},"2026-09-12",0.40723,{"date":263,"score":102,"percentile":264},"2026-09-13",0.4067,{"date":266,"score":102,"percentile":267},"2026-09-14",0.40699,{"date":269,"score":102,"percentile":270},"2026-09-15",0.40771,{"date":272,"score":102,"percentile":273},"2026-09-16",0.40957,{"date":275,"score":102,"percentile":276},"2026-09-17",0.41033,{"date":278,"score":102,"percentile":279},"2026-09-18",0.41176,{"date":141,"score":102,"percentile":142},[282,287,289,291,293],{"source":106,"cvss_v2_0":9,"cvss_v3_0":283,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":104,"baseSeverity":284,"vectorString":107,"impactScore":285,"exploitabilityScore":286},"HIGH",6,10,{"source":112,"cvss_v2_0":9,"cvss_v3_0":288,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":104,"baseSeverity":284,"vectorString":107,"impactScore":285,"exploitabilityScore":286},{"source":117,"cvss_v2_0":9,"cvss_v3_0":290,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":104,"baseSeverity":9,"vectorString":107,"impactScore":285,"exploitabilityScore":286},{"source":123,"cvss_v2_0":9,"cvss_v3_0":292,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":104,"baseSeverity":9,"vectorString":107,"impactScore":285,"exploitabilityScore":286},{"source":137,"cvss_v2_0":9,"cvss_v3_0":294,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":104,"baseSeverity":9,"vectorString":107,"impactScore":285,"exploitabilityScore":286},[296,313,320,324,329,332,344,351],{"ecosystem":297,"name":298,"vendor":299,"product":298,"cpe_part":9,"purl_type":300,"purl_namespace":299,"purl_name":298,"source":9,"versions":301},"Alpine Linux","nodejs","alpine","apk",[302,308,309,312],{"version":303,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":306,"version_end_type":307,"fixed_in":9},"lt22_23_2_r0",true,"ecosystem","22.23.2-r0","excluding",{"version":303,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":306,"version_end_type":307,"fixed_in":9},{"version":310,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":311,"version_end_type":307,"fixed_in":9},"lt24_18_1_r0","24.18.1-r0",{"version":310,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":311,"version_end_type":307,"fixed_in":9},{"ecosystem":314,"name":315,"vendor":316,"product":315,"cpe_part":9,"purl_type":300,"purl_namespace":316,"purl_name":315,"source":9,"versions":317},"Chainguard","nodejs-20","chainguard",[318],{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"ecosystem":314,"name":321,"vendor":316,"product":321,"cpe_part":9,"purl_type":300,"purl_namespace":316,"purl_name":321,"source":9,"versions":322},"nodejs-25",[323],{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":325,"name":315,"vendor":326,"product":315,"cpe_part":9,"purl_type":300,"purl_namespace":326,"purl_name":315,"source":9,"versions":327},"Wolfi","wolfi",[328],{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":325,"name":321,"vendor":326,"product":321,"cpe_part":9,"purl_type":300,"purl_namespace":326,"purl_name":321,"source":9,"versions":330},[331],{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":333,"name":298,"vendor":334,"product":298,"cpe_part":9,"purl_type":335,"purl_namespace":334,"purl_name":298,"source":9,"versions":336},"Debian","debian","deb",[337,338,339,340,341],{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":342,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":343,"version_end_type":307,"fixed_in":9},"lt24_19_0+dfsg+~cs24_13_3_1","24.19.0+dfsg+~cs24.13.3-1",{"ecosystem":345,"name":298,"vendor":346,"product":298,"cpe_part":9,"purl_type":335,"purl_namespace":346,"purl_name":298,"source":9,"versions":347},"Ubuntu","ubuntu",[348,349,350],{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":319,"is_range":304,"range_type":305,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":352,"vendor":298,"product":352,"cpe_part":353,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":354},"node","a",[355,359,362],{"version":356,"is_range":304,"range_type":106,"version_start":357,"version_start_type":358,"version_end":357,"version_end_type":358,"fixed_in":9},">= 26.5.0, \u003C= 26.5.0","26.5.0","including",{"version":360,"is_range":304,"range_type":106,"version_start":361,"version_start_type":358,"version_end":361,"version_end_type":358,"fixed_in":9},">= 24.18.0, \u003C= 24.18.0","24.18.0",{"version":363,"is_range":304,"range_type":106,"version_start":364,"version_start_type":358,"version_end":364,"version_end_type":358,"fixed_in":9},">= 22.23.1, \u003C= 22.23.1","22.23.1"]