Skip to content
OpenAdvisories
High ALAS2023-2026-1920 23 CVEs

Important: nodejs24 security update (Amazon Linux 2023)

Published Jul 6, 2026 · Updated Jul 24, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-9697: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. CVE-2026-9679: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 SS5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning. Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header. This was introduced in undici 7.0.0 CVE-2026-9678: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. CVE-2026-6734: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via #4385 and affects all versions through 8.1.0. CVE-2026-6733: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. CVE-2026-48937: A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**. CVE-2026-48935: A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48934: A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48933: A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48931: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48930: A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48928: A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48816: sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs24 1:24.18.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-debuginfo 1:24.18.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-debugsource 1:24.18.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-devel 1:24.18.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-docs 1:24.18.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-full-i18n 1:24.18.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-libs 1:24.18.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-libs-debuginfo 1:24.18.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-npm 1:11.16.0-1.24.18.0.1.amzn2023.0.1
Amazon Linux · 2023 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.amzn2023.0.1

Vulnerabilities 23

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-11525.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-11822.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-11824.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-12151.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48615.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48617.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48618.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48619.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48758.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48815.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48816.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48928.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48930.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48931.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48933.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48934.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48935.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48937.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-6733.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-6734.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-9678.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-9679.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-9697.html