[Git][security-tracker-team/security-tracker][master] Add new nodejs issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
31a9211d by Salvatore Bonaccorso at 2026-10-22T08:03:53+02:00
Add new nodejs issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,33 @@
+CVE-2026-105482
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#dnsresolve-truncates-names-containing-nul-char-cve-2026-105482---high
+CVE-2026-105483
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high
+CVE-2026-106069
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-host-loosely-resolves-to-an-ip-address-cve-2026-106069---high
+CVE-2026-111497
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
+CVE-2026-105481
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium
+CVE-2026-106072
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#improper-certificate-validation-for-non-canonical-ipv4-hostnames-allows-dns-sans-to-authenticate-ip-endpoints-cve-2026-106072---medium
+CVE-2026-106074
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#cryptorandomuuid-and-randomint-entropy-caches-are-saved-into-user-land-startup-snapshots-and-seas-so-every-process-repeats-the-same-values-cve-2026-106074---medium
+CVE-2026-106070
+	- nodejs <not-affected> (Vulnerable code introduced later)
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-zipfile-returns-attacker-controlled-prefix-bytes-after-failed-zip-header-validation-cve-2026-106070---low
+CVE-2026-106071
+	- nodejs <not-affected> (Vulnerable code introduced later)
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-filesystem-over-grant-via-wildcard-radix-lookup-cve-2026-106071---low
+CVE-2026-106073
+	- nodejs <unfixed>
+	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-bypass-with-fsrealpathsync-cve-2026-106073---low
 CVE-2026-112921
 	NOT-FOR-US: Robots::Validate Perl module
 CVE-2026-94423



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/31a9211dae962dab7e3bf6389fc27de7917e48c0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/31a9211dae962dab7e3bf6389fc27de7917e48c0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/e639a5ac/attachment.htm>