Summary
Node.js heeft meerdere kwetsbaarheden verholpen in versies 22.x, 24.x en 26.x, waaronder in de HTTP/2-implementatie, HTTPS-servermodule, TLS-handling en proxy error handling.
Details
Interpretaties
Verschillende kwetsbaarheden in Node.js kunnen leiden tot informatielekken, geheugenfouten en serveruitval. Vooral omgevingen met HTTP/2, HTTPS en TLS worden geraakt.
- Proxy-authenticatie: uitlekken van inloggegevens via foutmeldingen.
- HTTP/2: buffer overflow, geheugenlekken, overbelasting en servercrashes.
- Bestandsbewaking: omzeilen van toegangsbeperkingen op macOS en Windows.
- zlib: dienstverstoring door foutieve verwerking van datastromen.
- HTTPS-server: geheugenfouten waardoor gevoelige gegevens, waaronder TLS-privésleutels, kunnen uitlekken.
- TLS 1.2: omzeilen van authenticatie met clientcertificaten.
- TLS-sessies: onjuist hergebruik van sessies met verschillende certificaatinstellingen.
Oplossingen
Node.js heeft updates uitgebracht in versies 22.23.0, 24.17.0, 24.18.0 en 26.x om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 16
-
High 8.2
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TL…
-
High 8.1
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, includin…
-
High 8.1
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiat…
-
High 7.5
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a …
-
High 7.5
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connection…
-
High 7.5
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, w…
-
High 7.5
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacke…
-
Medium 6.8
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be r…
-
Medium 6.2
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy…
-
Medium 5.9
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt proc…
-
Medium 5.9
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream i…
-
Medium 5.9
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and clearte…
-
Medium 5.9
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…
-
Medium 4.2
Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, {…
-
Low 2.9
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is b…
-
Low 2.5
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process i…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://nodejs.org/en/blog/vulnerability/november-2026-security-releases