Node.js: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 12

• High 7.5
  CVE-2026-56846 Public exploit

  A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• High 7.5
  CVE-2026-56848 Public exploit

  A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• High 7.5
  CVE-2026-58043 Public exploit

  A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Medium 6.3
  CVE-2026-58040 Public exploit

  An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Medium 6.2
  CVE-2026-58045 Public exploit

  A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 5.9
  CVE-2026-58042 Public exploit

  A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 5.3
  CVE-2026-58041 Public exploit

  A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 4.3
  CVE-2026-48934

  A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 4.1
  CVE-2026-56850 Public exploit

  A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Low 3.7
  CVE-2026-58044 Public exploit

  A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Low 3.3
  CVE-2026-56847 Public exploit

  A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Low 3.3
  CVE-2026-58039 Public exploit

  A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 31, 2026

Revision history

1. 2026-11-11 #25

   Neue Updates von Red Hat und Oracle Linux aufgenommen

2. 2026-11-10 #24

   Neue Updates von IBM und Red Hat aufgenommen

3. 2026-11-09 #23

   Neue Updates von IBM aufgenommen

4. 2026-10-12 #22

   Neue Updates von Oracle Linux aufgenommen

5. 2026-10-01 #21

   Neue Updates von Debian aufgenommen

6. 2026-09-28 #20

   Neue Updates von SUSE aufgenommen

7. 2026-09-27 #19

   Neue Updates von Debian aufgenommen

8. 2026-09-20 #18

   Neue Updates von SUSE aufgenommen

9. 2026-09-17 #17

   Neue Updates von SUSE aufgenommen

10. 2026-09-09 #16

    Neue Updates von SUSE aufgenommen

11. 2026-09-07 #15

    Neue Updates von Red Hat aufgenommen

12. 2026-09-03 #14

    Neue Updates von Oracle Linux aufgenommen

13. 2026-09-02 #13

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

14. 2026-09-01 #12

    Neue Updates von Red Hat, Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

15. 2026-08-31 #11

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

16. 2026-08-30 #10

    Neue Updates von Red Hat aufgenommen

17. 2026-08-16 #9

    Neue Updates von SUSE und Oracle Linux aufgenommen

18. 2026-08-12 #8

    Neue Updates von openSUSE aufgenommen

19. 2026-08-11 #7

    Neue Updates von SUSE aufgenommen

20. 2026-08-06 #6

    Neue Updates von SUSE aufgenommen

21. 2026-08-04 #5

    Neue Updates von openSUSE und European Union Vulnerability Database aufgenommen

22. 2026-08-03 #4

    Referenz(en) aufgenommen: EUVD-2026-52563, EUVD-2026-52564, EUVD-2026-52553, EUVD-2026-52561, EUVD-2026-52562

23. 2026-08-02 #3

    Neue Updates von Oracle Linux aufgenommen

24. 2026-07-30 #2

    Referenz(en) aufgenommen: EUVD-2026-51369

25. 2026-07-29 #1

    Initiale Fassung

References

• Node.js Security Releases vom 2026-07-29
  https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
• Red Hat Security Advisory RHSA-2026:48273 vom 2026-07-30
  https://access.redhat.com/errata/RHSA-2026:48273
• Red Hat Security Advisory RHSA-2026:48537 vom 2026-07-30
  https://access.redhat.com/errata/RHSA-2026:48537
• Red Hat Security Advisory RHSA-2026:48305 vom 2026-07-30
  https://access.redhat.com/errata/RHSA-2026:48305
• Oracle Linux Security Advisory ELSA-2026-47059 vom 2026-08-01
  https://linux.oracle.com/errata/ELSA-2026-47059.html
• Oracle Linux Security Advisory ELSA-2026-47058 vom 2026-08-01
  http://linux.oracle.com/errata/ELSA-2026-47058.html
• Oracle Linux Security Advisory ELSA-2026-35841 vom 2026-08-01
  http://linux.oracle.com/errata/ELSA-2026-35841.html
• Oracle Linux Security Advisory ELSA-2026-47058 vom 2026-07-31
  https://linux.oracle.com/errata/ELSA-2026-47058.html
• openSUSE Security Update OPENSUSE-SU-2026:11440-1 vom 2026-08-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W43LDI4UUMRRTYSK6SE76VVRZYBBI2TA/
• openSUSE Security Update OPENSUSE-SU-2026:11439-1 vom 2026-08-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W5FJT6WBHLB7BZFCAVPKUZSDTK2O4HEU/
• SUSE Security Update SUSE-SU-2026:3520-1 vom 2026-08-06
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028163.html
• SUSE Security Update SUSE-SU-2026:3521-1 vom 2026-08-06
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028162.html
• SUSE Security Update SUSE-SU-2026:3557-1 vom 2026-08-11
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028195.html
• openSUSE Security Update OPENSUSE-SU-2026:21545-1 vom 2026-08-12
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OPJKH47FYO5R45MHTZORXX7LPOAACJQV/
• openSUSE Security Update OPENSUSE-SU-2026:21546-1 vom 2026-08-12
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GVRUVZOZTVUPOSSB5ZAPO3O4MOXWY7QR/
• SUSE Security Update SUSE-SU-2026:23155-1 vom 2026-08-14
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028297.html
• SUSE Security Update SUSE-SU-2026:23131-1 vom 2026-08-14
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028315.html
• SUSE Security Update SUSE-SU-2026:23130-1 vom 2026-08-14
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028316.html
• SUSE Security Update SUSE-SU-2026:23154-1 vom 2026-08-14
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028298.html
• Oracle Linux Security Advisory ELSA-2026-54530 vom 2026-08-15
  https://linux.oracle.com/errata/ELSA-2026-54530.html
• Red Hat Security Advisory RHSA-2026:61377 vom 2026-08-31
  https://access.redhat.com/errata/RHSA-2026:61377
• Red Hat Security Advisory RHSA-2026:61376 vom 2026-08-31
  https://access.redhat.com/errata/RHSA-2026:61376
• Rocky Linux Security Advisory RLSA-2026:61383 vom 2026-08-31
  https://errata.build.resf.org/RLSA-2026:61383
• Rocky Linux Security Advisory RLSA-2026:61386 vom 2026-08-31
  https://errata.build.resf.org/RLSA-2026:61386
• Red Hat Security Advisory RHSA-2026:62416 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62416
• Red Hat Security Advisory RHSA-2026:62219 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62219
• Oracle Linux Security Advisory ELSA-2026-61376 vom 2026-09-02
  https://linux.oracle.com/errata/ELSA-2026-61376-0.html
• Rocky Linux Security Advisory RLSA-2026:62219 vom 2026-09-02
  https://errata.build.resf.org/RLSA-2026:62219
• Red Hat Security Advisory RHSA-2026:62583 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62583
• Rocky Linux Security Advisory RLSA-2026:61377 vom 2026-09-02
  https://errata.build.resf.org/RLSA-2026:61377
• Rocky Linux Security Advisory RLSA-2026:61376 vom 2026-09-02
  https://errata.build.resf.org/RLSA-2026:61376
• Oracle Linux Security Advisory ELSA-2026-61383 vom 2026-09-02
  https://linux.oracle.com/errata/ELSA-2026-61383-0.html
• Oracle Linux Security Advisory ELSA-2026-61386 vom 2026-09-02
  https://linux.oracle.com/errata/ELSA-2026-61386-0.html
• Rocky Linux Security Advisory RLSA-2026:62583 vom 2026-09-02
  https://errata.build.resf.org/RLSA-2026:62583
• Oracle Linux Security Advisory ELSA-2026-62219 vom 2026-09-03
  https://linux.oracle.com/errata/ELSA-2026-62219-0.html
• Oracle Linux Security Advisory ELSA-2026-61377 vom 2026-09-04
  https://linux.oracle.com/errata/ELSA-2026-61377-0.html
• Oracle Linux Security Advisory ELSA-2026-62583 vom 2026-09-03
  https://linux.oracle.com/errata/ELSA-2026-62583-0.html
• Red Hat Security Advisory RHSA-2026:64817 vom 2026-09-08
  https://access.redhat.com/errata/RHSA-2026:64817
• SUSE Security Update SUSE-SU-2026:3930-1 vom 2026-09-10
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/028803.html
• SUSE Security Update SUSE-SU-2026:3929-1 vom 2026-09-10
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/028804.html
• SUSE Security Update SUSE-SU-2026:4248-1 vom 2026-09-17
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029224.html
• SUSE Security Update SUSE-SU-2026:4261-1 vom 2026-09-18
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029230.html
• Debian Security Advisory DSA-6517 vom 2026-09-26
  https://security-tracker.debian.org/tracker/DSA-6517-1
• SUSE Security Update SUSE-SU-2026:4355-1 vom 2026-09-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029417.html
• Debian Security Advisory DLA-4809 vom 2026-10-01
  https://lists.debian.org/debian-lts-announce/2026/10/msg00001.html
• Oracle Linux Security Advisory ELSA-2026-76750 vom 2026-10-12
  https://linux.oracle.com/errata/ELSA-2026-76750.html
• IBM Security Bulletin 7296009 vom 2026-11-09
  https://www.ibm.com/support/pages/node/7296009
• IBM Security Bulletin 7296252 vom 2026-11-11
  https://www.ibm.com/support/pages/node/7296252
• Red Hat Security Advisory RHSA-2026:97855 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:97855
• Rocky Linux Security Advisory RLSA-2026:97855 vom 2026-11-11
  https://errata.build.resf.org/RLSA-2026:97855
• Red Hat Security Advisory RHSA-2026:98619 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98619
• Oracle Linux Security Advisory ELSA-2026-96234 vom 2026-11-12
  http://linux.oracle.com/errata/ELSA-2026-96234.html