[Git][security-tracker-team/security-tracker][master] Track nodejs issues fixed in unstable
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 27 04:37:05 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3bc0a549 by Salvatore Bonaccorso at 2026-10-27T05:31:22+01:00
Track nodejs issues fixed in unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4828,23 +4828,23 @@ CVE-2026-102483 (Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remo
[trixie] - ntpsec <no-dsa> (Minor issue)
NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
CVE-2026-105482 (A flaw in Node.js DNS resolution allows hostnames containing a NUL byt ...)
- - nodejs <unfixed> (bug #1151688; bug #1151859)
+ - nodejs 24.22.1+dfsg+~cs24.19.2-1 (bug #1151688; bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#dnsresolve-truncates-names-containing-nul-char-cve-2026-105482---high
NOTE: Fixed by: https://github.com/nodejs/node/commit/19c505600222626bb1457a723418b2b8f9d6c400 (v22.23.4)
CVE-2026-105483 (A flaw in Node.js TLS hostname verification allows a certificate witho ...)
- - nodejs <unfixed> (bug #1151688; bug #1151859)
+ - nodejs 24.22.1+dfsg+~cs24.19.2-1 (bug #1151688; bug #1151859)
[trixie] - nodejs <not-affected> (vulnerable code introduced later)
[bookworm] - nodejs <not-affected> (vulnerable code introduced later)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high
NOTE: Regression of CVE-2026-48618 on node24 and node26 not present before
CVE-2026-106069 (A flaw in Node.js TLS hostname verification can cause a server certifi ...)
- - nodejs <unfixed> (bug #1151688; bug #1151859)
+ - nodejs 24.22.1+dfsg+~cs24.19.2-1 (bug #1151688; bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-host-loosely-resolves-to-an-ip-address-cve-2026-106069---high
NOTE: Fixed by: https://github.com/nodejs/node/commit/d7663560ac9e7bb4ddd659e3120c99a55490f18d (v22.23.4)
CVE-2026-111497 (A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) ...)
{DSA-6582-1 DLA-4855-1}
- brotli 1.2.0-4.1 (bug #1151690)
- - nodejs <unfixed> (unimportant)
+ - nodejs 24.22.1+dfsg+~cs24.19.2-1 (unimportant)
- python-brotlicffi 1.2.1.0+ds-1 (unimportant)
NOTE: nodejs and python-brotlicffi use system provided brotli library
NOTE: nodejs may need error constant define https://github.com/nodejs/node/commit/a18ec92752cd05ad5335bfaa5420a258b81f9afc
@@ -4853,15 +4853,15 @@ CVE-2026-111497 (A buffer overflow vulnerability in the Brotli decoder (c/dec/de
NOTE: Fixed by: https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12 (v1.1.1)
NOTE: Fixed by: https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0 (v1.0.10)
CVE-2026-105481 (A flaw in Node.js HTTP Agent connection reuse can cause a client to ac ...)
- - nodejs <unfixed> (bug #1151688; bug #1151859)
+ - nodejs 24.22.1+dfsg+~cs24.19.2-1 (bug #1151688; bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium
NOTE: Fixed by: https://github.com/nodejs/node/commit/e7b2985d5978add59d8a9d58743a5884d2b3eabc (v22.23.4)
CVE-2026-106072 (A flaw in Node.js TLS hostname verification allows a certificate with ...)
- - nodejs <unfixed> (bug #1151688; bug #1151859)
+ - nodejs 24.22.1+dfsg+~cs24.19.2-1 (bug #1151688; bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#improper-certificate-validation-for-non-canonical-ipv4-hostnames-allows-dns-sans-to-authenticate-ip-endpoints-cve-2026-106072---medium
NOTE: Fixed by: https://github.com/nodejs/node/commit/beb4cd4cd31c8a6726102baabf441cad93eae3b1 (v22.23.4)
CVE-2026-106074 (A flaw in Node.js `crypto` causes the internal entropy caches used by ...)
- - nodejs <unfixed> (bug #1151688; bug #1151859)
+ - nodejs 24.22.1+dfsg+~cs24.19.2-1 (bug #1151688; bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#cryptorandomuuid-and-randomint-entropy-caches-are-saved-into-user-land-startup-snapshots-and-seas-so-every-process-repeats-the-same-values-cve-2026-106074---medium
NOTE: Fixed by: https://github.com/nodejs/node/commit/dd6b47573b54aa368cc088636f23460b5ed5f0f9 (v22.23.4)
CVE-2026-106070 (A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes ...)
@@ -4871,7 +4871,7 @@ CVE-2026-106071 (A flaw in Node.js Permission Model filesystem enforcement can g
- nodejs <not-affected> (Vulnerable code introduced later)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-filesystem-over-grant-via-wildcard-radix-lookup-cve-2026-106071---low
CVE-2026-106073 (A flaw in Node.js Permission Model filesystem enforcement leaves `fs.r ...)
- - nodejs <unfixed> (bug #1151688; bug #1151859)
+ - nodejs 24.22.1+dfsg+~cs24.19.2-1 (bug #1151688; bug #1151859)
NOTE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-bypass-with-fsrealpathsync-cve-2026-106073---low
NOTE: Fixed by: https://github.com/nodejs/node/commit/50ab804edc82648b2b7681bda2f9af9316dfdfbb (v22.23.4)
CVE-2026-112921 (Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report cli ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3bc0a549432a785043172126df11b8b7e237be37
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3bc0a549432a785043172126df11b8b7e237be37
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/d165d9f6/attachment.htm>
More information about the debian-security-tracker-commits
mailing list