[Git][security-tracker-team/security-tracker][master] Reference Debian bug report for nodejs issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
29fb98e6 by Salvatore Bonaccorso at 2026-10-24T16:43:07+02:00
Reference Debian bug report for nodejs issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3530,13 +3530,13 @@ CVE-2026-102483 (Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remo
 	[trixie] - ntpsec <no-dsa> (Minor issue)
 	NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
 CVE-2026-105482 (A flaw in Node.js DNS resolution allows hostnames containing a NUL byt ...)
-	- nodejs <unfixed> (bug #1151859)
+	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#dnsresolve-truncates-names-containing-nul-char-cve-2026-105482---high
 CVE-2026-105483 (A flaw in Node.js TLS hostname verification allows a certificate witho ...)
-	- nodejs <unfixed> (bug #1151859)
+	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high
 CVE-2026-106069 (A flaw in Node.js TLS hostname verification can cause a server certifi ...)
-	- nodejs <unfixed> (bug #1151859)
+	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-host-loosely-resolves-to-an-ip-address-cve-2026-106069---high
 CVE-2026-111497 (A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) ...)
 	{DSA-6582-1 DLA-4855-1}
@@ -3548,13 +3548,13 @@ CVE-2026-111497 (A buffer overflow vulnerability in the Brotli decoder (c/dec/de
 	NOTE: Fixed by: https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12 (v1.1.1)
 	NOTE: Fixed by: https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0 (v1.0.10)
 CVE-2026-105481 (A flaw in Node.js HTTP Agent connection reuse can cause a client to ac ...)
-	- nodejs <unfixed> (bug #1151859)
+	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium
 CVE-2026-106072 (A flaw in Node.js TLS hostname verification allows a certificate with  ...)
-	- nodejs <unfixed> (bug #1151859)
+	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#improper-certificate-validation-for-non-canonical-ipv4-hostnames-allows-dns-sans-to-authenticate-ip-endpoints-cve-2026-106072---medium
 CVE-2026-106074 (A flaw in Node.js `crypto` causes the internal entropy caches used by  ...)
-	- nodejs <unfixed> (bug #1151859)
+	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#cryptorandomuuid-and-randomint-entropy-caches-are-saved-into-user-land-startup-snapshots-and-seas-so-every-process-repeats-the-same-values-cve-2026-106074---medium
 CVE-2026-106070 (A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes  ...)
 	- nodejs <not-affected> (Vulnerable code introduced later)
@@ -3563,7 +3563,7 @@ CVE-2026-106071 (A flaw in Node.js Permission Model filesystem enforcement can g
 	- nodejs <not-affected> (Vulnerable code introduced later)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-filesystem-over-grant-via-wildcard-radix-lookup-cve-2026-106071---low
 CVE-2026-106073 (A flaw in Node.js Permission Model filesystem enforcement leaves `fs.r ...)
-	- nodejs <unfixed> (bug #1151859)
+	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-bypass-with-fsrealpathsync-cve-2026-106073---low
 CVE-2026-112921 (Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report cli ...)
 	NOT-FOR-US: Robots::Validate Perl module



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/29fb98e66df2d4147ff48625a3139e84ced7b42f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/29fb98e66df2d4147ff48625a3139e84ced7b42f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/b8d57842/attachment.htm>