CVE-2026-105483: Debian Node.js advisory lacks vulnerability details
Summary
DEBIAN-CVE-2026-105483: The available advisory data does not describe the vulnerability class, affected component, or potential impact. Affects nodejs versions 18.13.0+dfsg1-1 – 24.22.0+dfsg+~cs24.19.2-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a software package in the Debian ecosystem. It provides a JavaScript runtime used to run JavaScript applications and tools outside a browser. The advisory identifies the package across Debian releases, but does not provide further details about its use in a particular application or deployment.
Vulnerability Detail
The advisory does not publish the vulnerability class, affected function, or component, so the specific impact is not described. It identifies Node.js as affected in Debian 12, Debian 13, and Debian 14, with each listed range introduced at 0 and no fixed event supplied. The urgency is not yet assigned, and a CVSS score is not published.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to applications that depend on Node.js and limit their permissions while awaiting published remediation details. The advisory does not describe the vulnerability mechanics, so a more specific mitigation cannot be grounded in the available data.
Conclusion
No fixed version is published for Node.js in Debian 12. The advisory also omits the vulnerability class and impact, so monitor for updated remediation details and apply a fix when one is published. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for nodejs →
FAQ
The advisory lists Node.js as affected from version 0 in Debian 12; it does not publish an upper bound.
The advisory does not describe what an attacker can do through CVE-2026-105483 or identify the vulnerability class.
No fixed version or upgrade command for CVE-2026-105483 in Debian 12 is published in the supplied advisory.
Restrict access to applications using Node.js and limit their permissions; the advisory documents no vendor workaround.
Inspect the application's dependency manifest or SBOM for Node.js. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
