Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-126051: A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x. CVE-2026-123877: A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x. CVE-2026-123875: A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x. CVE-2026-123874: A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0). CVE-2026-123872: A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x. CVE-2026-123871: Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x. CVE-2026-123868: An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x. CVE-2026-123867: A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs24 | 1:24.22.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs24-debuginfo | 1:24.22.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs24-debugsource | 1:24.22.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs24-devel | 1:24.22.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs24-docs | 1:24.22.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs24-full-i18n | 1:24.22.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs24-libs | 1:24.22.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs24-libs-debuginfo | 1:24.22.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs24-npm | 1:11.19.1-1.24.22.3.1.amzn2023.0.1 |
| Amazon Linux · 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.3.1.amzn2023.0.1 |
Vulnerabilities 27
-
High 8.2
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TL…
-
High 8.1
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, includin…
-
High 8.1
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiat…
-
High 7.8
SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix…
-
High 7.8
SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when d…
-
High 7.8
SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changes…
-
High 7.5
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a …
-
High 7.5
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connection…
-
High 7.5
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, w…
-
High 7.5
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacke…
-
Medium 6.8
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be r…
-
Medium 6.5
undici vulnerable to cross-user cache disclosure via same-origin redirect
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final res…
-
Medium 6.2
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy…
-
Medium 5.9
undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not …
-
Medium 5.9
undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, wh…
-
Medium 5.9
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt proc…
-
Medium 5.9
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream i…
-
Medium 5.9
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and clearte…
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands…
-
Medium 5.5
SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operato…
-
Medium 5.5
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payloa…
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted datab…
-
Medium 5.5
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or wi…
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can t…
-
Medium 4.2
Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, {…
-
Low 3.6CVE-2026-106071 Public exploit
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
Low 2.9
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is b…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123872.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-116630.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-126051.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-120423.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123867.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119373.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119379.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123828.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123877.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119371.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119591.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119372.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-120474.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119375.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123864.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119376.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123874.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123862.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123863.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119378.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-119374.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123868.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-106071.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123866.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123875.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123865.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-123871.html