The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-develUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npm | Jul 7, 2026 | Jul 6, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jun 29, 2026 | Jun 26, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs22-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-docsUpgrade nodejs22-debugsourceUpgrade nodejs24Upgrade nodejs24-libsUpgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs24-npmUpgrade nodejs22-npmUpgrade nodejs22Upgrade nodejs22-docsUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs22-libs | Jul 8, 2026 | Jun 26, 2026 |
| Nodejs | — | Upgrade Node.js to 22.23.0, 24.17.0 or 26.3.1 or later | Oct 28, 2026 | Jun 26, 2026 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs24-full-i18nUpgrade nodejs24Upgrade nodejs24-libsUpgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs24-docsUpgrade nodejs-docsUpgrade nodejs24-npmUpgrade nodejs-npmUpgrade nodejs-nodemonUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs24-develUpgrade npm | Oct 22, 2026 | Jun 26, 2026 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoNo solution existsUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs24-docsUpgrade nodejs-npmUpgrade nodejs-packagingUpgrade nodejs24-full-i18nUpgrade nodejs-libsUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs22-debugsourceUpgrade npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs24-npmUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs22-debuginfoUpgrade nodejs-devel | Jul 7, 2026 | Jun 26, 2026 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs24Upgrade nodejs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade nodejs22-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs24-develUpgrade npmUpgrade v8-13.6-develUpgrade nodejs22-debuginfoUpgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejs-full-i18n | Jul 10, 2026 | Jul 7, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2026 | Jun 26, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub