From 03782e2ffcfefe9c5ab3d83485938ec20a424e8b Mon Sep 17 00:00:00 2001 From: "Node.js GitHub Bot" Date: Fri, 21 Aug 2026 18:58:58 +0000 Subject: [PATCH] Sync security vulnerabilities --- vuln/core/184.json | 14 ++++++++++++++ vuln/core/185.json | 14 ++++++++++++++ vuln/core/186.json | 14 ++++++++++++++ vuln/core/187.json | 14 ++++++++++++++ vuln/core/188.json | 14 ++++++++++++++ vuln/core/189.json | 14 ++++++++++++++ vuln/core/190.json | 14 ++++++++++++++ vuln/core/191.json | 14 ++++++++++++++ vuln/core/192.json | 14 ++++++++++++++ vuln/core/193.json | 14 ++++++++++++++ vuln/core/194.json | 14 ++++++++++++++ 11 files changed, 154 insertions(+) create mode 100644 vuln/core/184.json create mode 100644 vuln/core/185.json create mode 100644 vuln/core/186.json create mode 100644 vuln/core/187.json create mode 100644 vuln/core/188.json create mode 100644 vuln/core/189.json create mode 100644 vuln/core/190.json create mode 100644 vuln/core/191.json create mode 100644 vuln/core/192.json create mode 100644 vuln/core/193.json create mode 100644 vuln/core/194.json diff --git a/vuln/core/184.json b/vuln/core/184.json new file mode 100644 index 00000000..1c2500e9 --- /dev/null +++ b/vuln/core/184.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-56846" + ], + "vulnerable": "22.x || 24.x", + "patched": "^22.23.2 || ^24.18.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion", + "overview": "A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\n\nThis vulnerability affects Node.js **24.x** and **22.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/185.json b/vuln/core/185.json new file mode 100644 index 00000000..32671b3c --- /dev/null +++ b/vuln/core/185.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-56847" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`", + "overview": "A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/186.json b/vuln/core/186.json new file mode 100644 index 00000000..fdca2f8f --- /dev/null +++ b/vuln/core/186.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-56848" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2", + "overview": "A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/187.json b/vuln/core/187.json new file mode 100644 index 00000000..5ea3dedf --- /dev/null +++ b/vuln/core/187.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-56850" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates", + "overview": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/188.json b/vuln/core/188.json new file mode 100644 index 00000000..d329b8a3 --- /dev/null +++ b/vuln/core/188.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-58039" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths", + "overview": "A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/189.json b/vuln/core/189.json new file mode 100644 index 00000000..9598e009 --- /dev/null +++ b/vuln/core/189.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-58040" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)", + "overview": "An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/190.json b/vuln/core/190.json new file mode 100644 index 00000000..219b3a32 --- /dev/null +++ b/vuln/core/190.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-58041" + ], + "vulnerable": "24.x || 26.x", + "patched": "^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely", + "overview": "A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/191.json b/vuln/core/191.json new file mode 100644 index 00000000..0318f548 --- /dev/null +++ b/vuln/core/191.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-58042" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records", + "overview": "A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.\n\nRepeated triggering of this condition can lead to denial of service.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/192.json b/vuln/core/192.json new file mode 100644 index 00000000..3d394ccf --- /dev/null +++ b/vuln/core/192.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-58043" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant", + "overview": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\n\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\n\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/193.json b/vuln/core/193.json new file mode 100644 index 00000000..020db269 --- /dev/null +++ b/vuln/core/193.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-58044" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser", + "overview": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\n\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/194.json b/vuln/core/194.json new file mode 100644 index 00000000..e5339f75 --- /dev/null +++ b/vuln/core/194.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-58045" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.2 || ^24.18.1 || ^26.5.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", + "description": "Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)", + "overview": "A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.\n\nRepeated exploitation of this condition can result in a denial of service.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +}