[Git][security-tracker-team/security-tracker][master] nodejs triagging

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4e4f945d by Bastien Roucariès at 2026-10-26T00:04:34+01:00
nodejs triagging

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4059,6 +4059,7 @@ CVE-2026-111497 (A buffer overflow vulnerability in the Brotli decoder (c/dec/de
 CVE-2026-105481 (A flaw in Node.js HTTP Agent connection reuse can cause a client to ac ...)
 	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium
+	NOTE: Fixed by: https://github.com/nodejs/node/commit/e7b2985d5978add59d8a9d58743a5884d2b3eabc (v22.23.4)
 CVE-2026-106072 (A flaw in Node.js TLS hostname verification allows a certificate with  ...)
 	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#improper-certificate-validation-for-non-canonical-ipv4-hostnames-allows-dns-sans-to-authenticate-ip-endpoints-cve-2026-106072---medium
@@ -4066,6 +4067,7 @@ CVE-2026-106072 (A flaw in Node.js TLS hostname verification allows a certificat
 CVE-2026-106074 (A flaw in Node.js `crypto` causes the internal entropy caches used by  ...)
 	- nodejs <unfixed> (bug #1151688; bug #1151859)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#cryptorandomuuid-and-randomint-entropy-caches-are-saved-into-user-land-startup-snapshots-and-seas-so-every-process-repeats-the-same-values-cve-2026-106074---medium
+	NOTE: Fixed by: https://github.com/nodejs/node/commit/dd6b47573b54aa368cc088636f23460b5ed5f0f9 (v22.23.4)
 CVE-2026-106070 (A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes  ...)
 	- nodejs <not-affected> (Vulnerable code introduced later)
 	NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-zipfile-returns-attacker-controlled-prefix-bytes-after-failed-zip-header-validation-cve-2026-106070---low



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e4f945d549b174a9ef135902b98f5dc0d5a2079

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e4f945d549b174a9ef135902b98f5dc0d5a2079
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261025/b7ee0fa6/attachment.htm>