One CVE, four calendars

We watched the same Node.js vulnerability get fixed on four Linux families — up to a month apart, and on one of them not at all. Every date below came out of our own advisory mirror, and every claim resolves to a public advisory ID you can check.

2 September 2026 · measured against a mirror of 140,975 distro security advisories

CVE-2026-56846 is one of the CVEs in Node.js’s latest security release batch. It has exactly one publication date. The fix for it does not — when it reached you depends entirely on whose packages you run. Here is where that fix was, by date, this week:

Two things in that table broke our assumptions

The “rebuild lag” myth ran backwards. The standing assumption about RHEL rebuilds is that they trail their upstream. Rocky’s advisories carry an Aug 31 date — a day before the RHEL errata they rebuild. Whatever you believe about rebuild lag, this week it was zero.

The fix existed somewhere for a month. Red Hat’s Hardened Images channel shipped it Jul 31. If you pay for that product line, you were patched a month before a standard RHEL subscription could be. A fix’s existence and a fix’s availability to you are different facts, and the gap between them is commercial, not technical.

The Debian line is the one that matters

A vulnerability scanner pointed at a Debian stable box shows nothing for this CVE — not because the box is safe, but because there is no fixed version to compare against and nobody has assigned an urgency yet. An empty scan result and a clean bill of health look identical, and they are not the same thing. This is the quietest failure mode in vulnerability management: absence of findings reading as absence of risk.

Why we can see this at all

ScopeHunter mirrors the security advisories of five Linux families (and Microsoft’s security updates) nightly, and correlates them against the packages each enrolled host actually reports — including the distinction between a fix that is installed and one that is running. That vantage is what makes a table like the one above a query rather than an afternoon of tab-hopping across five security trackers.

The takeaway is not “distro X is slow.” Release engineering is hard, backports are real work, and every one of these teams ships fixes for free software they did not break. The takeaway is that “is there a CVE?” and “is there a fix for my box?” are different questions — the first has one answer, the second has as many answers as you have package sources. If your vulnerability process is built on a CVE feed, you are reading the first answer and acting on the second.

Written from ScopeHunter’s own advisory mirror on 2 September 2026. Method: one SQL query over mirrored OSV records, then a manual pass to separate product channels (the Jul 31 entries are Hardened Images, not RHEL proper — a distinction our first draft got wrong and the receipts corrected).