Source: nodejs X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for nodejs. CVE-2026-105481[0]: | A flaw in Node.js HTTP Agent connection reuse can cause a client to | accept as valid a response that was sent before the client has sent | the request. This is an incomplete fix of CVE-2026-48931. The guard | that destroys idle keep-alive sockets when unexpected data arrives | only runs when the event loop polls for I/O. If an unsolicited | response has already reached the socket but has not been read yet | when the socket is handed to a new request, for example because the | event loop was busy with synchronous work, the guard is removed | without seeing it and the data is parsed as the response to the new | request. This vulnerability affects Node.js **26.x**, **24.x**, and | **22.x**. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium CVE-2026-106069[1]: | A flaw in Node.js TLS hostname verification can cause a server | certificate to be validated against a different IP address than the | one the client connected to, when the host is a non-canonical IPv4 | literal with a leading zero, such as `0127.0.0.1`. | `tls.checkServerIdentity()` normalizes the host following the WHATWG | URL rules, which read a leading-zero octet as octal (`0127.0.0.1` | becomes `87.0.0.1`), while the connection is made through the | operating system resolver, which on some platforms such as macOS | reads it as decimal (`127.0.0.1`). A server at the connected address | can then be authenticated with a certificate issued for another IP | address. This vulnerability affects Node.js **26.x**, **24.x**, and | **22.x**. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-host-loosely-resolves-to-an-ip-address-cve-2026-106069---high CVE-2026-106072[2]: | A flaw in Node.js TLS hostname verification allows a certificate | with only a DNS SAN to authenticate an IP endpoint when the client | connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, | `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` | did not classify these hosts as IP addresses, but normalized them to | their canonical form and matched the result against the certificate | DNS names. A certificate containing `DNS:127.0.0.1` and no `IP | Address:127.0.0.1` SAN was therefore accepted, while the same | certificate is correctly rejected for `127.0.0.1`. Exploitation | requires a certificate with a numeric DNS SAN issued by a CA trusted | by the client, and a platform resolver that accepts these spellings, | such as glibc. This vulnerability affects Node.js **26.x**, | **24.x**, and **22.x**. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#improper-certificate-validation-for-non-canonical-ipv4-hostnames-allows-dns-sans-to-authenticate-ip-endpoints-cve-2026-106072---medium CVE-2026-106073[3]: | A flaw in Node.js Permission Model filesystem enforcement leaves | `fs.realpathSync()` without the required read permission checks. | This is an incomplete fix of CVE-2026-21715, which only covered | `fs.realpathSync.native()`. As a result, code running under | `--permission` with restricted `--allow-fs-read` can still use | `fs.realpathSync()` to check file existence, resolve symlink | targets, and enumerate filesystem paths outside of permitted | directories. This vulnerability affects Node.js **26.x**, **24.x**, | and **22.x**. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-bypass-with-fsrealpathsync-cve-2026-106073---low CVE-2026-106074[4]: | A flaw in Node.js `crypto` causes the internal entropy caches used | by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and | `crypto.randomInt()` to be saved into user-land startup snapshots | (`--build-snapshot`) and single executable applications built with | `useSnapshot`. If any of these functions, or an API that relies on | them such as `URL.createObjectURL()`, is called while the snapshot | is built, every process started from that snapshot returns the same | values until the cache is refilled: up to 127 UUIDs and about 1,000 | `randomInt()` values. Identifiers expected to be unique can collide | across processes, and values issued by one process can be predicted | by observing another. This vulnerability affects Node.js **26.x**, | **24.x**, and **22.x**. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#cryptorandomuuid-and-randomint-entropy-caches-are-saved-into-user-land-startup-snapshots-and-seas-so-every-process-repeats-the-same-values-cve-2026-106074---medium CVE-2026-105482[5]: | A flaw in Node.js DNS resolution allows hostnames containing a NUL | byte to be silently truncated by the dns.resolve*() functions and | dns.reverse(). This is an incomplete fix of CVE-2026-48930, which | only covered dns.lookup() and the net/tls host options. Because | the name is passed to c-ares as a C string, resolving | attacker.example\0.trusted.example queries attacker.example and | returns its records without any error. Applications that validate a | hostname, for example against a domain allowlist, and then resolve | it with dns.resolve*() can act on records for a different name than | the one they validated. This vulnerability affects Node.js 26.x, | 24.x, and 22.x. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#dnsresolve-truncates-names-containing-nul-char-cve-2026-105482---high CVE-2026-105483[6]: | A flaw in Node.js TLS hostname verification allows a certificate | without a matching IP address SAN to authenticate a connection to an | IPv4 address when the host is written with non-ASCII characters, | such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` | did not recognize such hosts as IP addresses, even though they | normalize and resolve to a regular IPv4 address, and matched them | against the certificate DNS names and Common Name instead. A | certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could | therefore be accepted for an IP endpoint it was not issued for. This | is a regression introduced after the fix for CVE-2026-48618. This | vulnerability affects Node.js **26.x** and **24.x**. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-105481 https://www.cve.org/CVERecord?id=CVE-2026-105481 [1] https://security-tracker.debian.org/tracker/CVE-2026-106069 https://www.cve.org/CVERecord?id=CVE-2026-106069 [2] https://security-tracker.debian.org/tracker/CVE-2026-106072 https://www.cve.org/CVERecord?id=CVE-2026-106072 [3] https://security-tracker.debian.org/tracker/CVE-2026-106073 https://www.cve.org/CVERecord?id=CVE-2026-106073 [4] https://security-tracker.debian.org/tracker/CVE-2026-106074 https://www.cve.org/CVERecord?id=CVE-2026-106074 [5] https://security-tracker.debian.org/tracker/CVE-2026-105482 https://www.cve.org/CVERecord?id=CVE-2026-105482 [6] https://security-tracker.debian.org/tracker/CVE-2026-105483 https://www.cve.org/CVERecord?id=CVE-2026-105483 Please adjust the affected versions in the BTS as needed. -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
