nodejs - security update

Fixed packages 1

Vulnerabilities 7

• High 7.5
  CVE-2026-21710 Public exploit EPSS 25%

  A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Medium 5.9
  CVE-2026-21637

  A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• Medium 5.9
  CVE-2026-21713

  A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Medium 5.9
  CVE-2026-21717 Public exploit

  A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Medium 5.3
  CVE-2026-21714

  A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Low 3.3
  CVE-2026-21715

  A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Low 3.3
  CVE-2026-21716

  An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026