[Git][security-tracker-team/security-tracker][master] Add new nodejs issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5e0356c5 by Salvatore Bonaccorso at 2026-01-14T07:10:55+01:00
Add new nodejs issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,27 @@
+CVE-2025-55132 [fs.futimes() Bypasses Read-Only Permission Model]
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#fsfutimes-bypasses-read-only-permission-model-cve-2025-55132---low
+CVE-2026-21637 [TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak]
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium
+CVE-2026-21636 [Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)]
+	- nodejs <not-affected> (Only affects Node.js v25)
+	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#nodejs-permission-model-bypass-via-unchecked-unix-domain-socket-connections-uds-cve-2026-21636---medium
+CVE-2025-59464 [Memory leak that enables remote Denial of Service against applications processing TLS client certificates]
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#memory-leak-that-enables-remote-denial-of-service-against-applications-processing-tls-client-certificates-cve-2025-59464---medium
+CVE-2025-59466 [Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers]
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#uncatchable-maximum-call-stack-size-exceeded-error-on-nodejs-via-async_hooks-leads-to-process-crashes-bypassing-error-handlers-cve-2025-59466---medium
+CVE-2025-59465 [Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame]
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#nodejs-http2-server-crashes-with-unhandled-error-when-receiving-malformed-headers-frame-cve-2025-59465---high
+CVE-2025-55130 [Bypass File System Permissions using crafted symlinks]
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#bypass-file-system-permissions-using-crafted-symlinks-cve-2025-55130---high
+CVE-2025-55131 [Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled]
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#timeout-based-race-conditions-make-uint8arraybufferalloc-non-zerofilled-cve-2025-55131---high
 CVE-2026-0908
 	- chromium 144.0.7559.59-1
 	[bullseye] - chromium <end-of-life> (see #1061268)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e0356c52b71e31ebad77eedd43acb0a3d413d9a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e0356c52b71e31ebad77eedd43acb0a3d413d9a
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260114/84c275cf/attachment-0001.htm>