{
 "arch": "amd64",
 "findings": [
  {
   "affects": [
    "openssl"
   ],
   "cvss": 9.1,
   "distro_severity": "low",
   "fix_state": "fixed",
   "fixed_in": [
    "3.5.5-1ubuntu3.5"
   ],
   "id": "CVE-2026-75803",
   "severity": "critical",
   "title": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.",
   "url": "https://ubuntu.com/security/CVE-2026-75803"
  },
  {
   "affects": [
    "zlib"
   ],
   "cvss": 8.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-85091",
   "severity": "high",
   "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.",
   "url": "https://ubuntu.com/security/CVE-2026-85091"
  },
  {
   "affects": [
    "c-ares"
   ],
   "cvss": 7.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-33630",
   "severity": "high",
   "title": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling.",
   "url": "https://ubuntu.com/security/CVE-2026-33630"
  },
  {
   "affects": [
    "sqlite3"
   ],
   "cvss": 4.0,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-39113",
   "severity": "medium",
   "title": "Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-39113"
  },
  {
   "affects": [
    "c-ares"
   ],
   "cvss": null,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-69184",
   "severity": "medium",
   "title": "CVE-2026-69184",
   "url": "https://ubuntu.com/security/CVE-2026-69184"
  },
  {
   "affects": [
    "c-ares"
   ],
   "cvss": null,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-69186",
   "severity": "medium",
   "title": "CVE-2026-69186",
   "url": "https://ubuntu.com/security/CVE-2026-69186"
  }
 ],
 "findings_changed_at": "2026-09-16T13:22:27Z",
 "image": "nodejs",
 "inputs": {
  "sbom_sha256": "c521fcc001364470db820573fc0c7921a6b365675dc01db4bfa86f3954094050"
 },
 "platform_digest": "sha256:c0c6bfb0ce95d66003214633ac28042ea1c24a5c9598b0a98599104f33769dca",
 "project": "nodejs",
 "receipt_sha256": "0de6c1a1efa14c04fa489a7f6c07182e2e05dc8310b239d777a75b28fcea1f83",
 "scanner": "grype",
 "severity_counts": {
  "critical": 1,
  "high": 2,
  "low": 0,
  "medium": 3,
  "unknown": 0
 },
 "suppressed": [
  {
   "affects": [
    "zlib"
   ],
   "by": "vex",
   "id": "CVE-2026-27171"
  }
 ],
 "version": "26.8.1",
 "vex_applied": [
  "nodejs-26.8.1-amd64.vex.json",
  "nodejs-26.8.1-amd64.ubuntu-vex.json"
 ]
}