CVE-2026-21715

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct.

When this occurs, dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch.

• This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x(CVE-2026-21710)

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.(CVE-2026-21713)

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.(CVE-2026-21714)

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.(CVE-2026-21715)

An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown()) were correctly patched.

As a result, code running under --permission with restricted --allow-fs-write can still use promise-based FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-write is intentionally restricted.(CVE-2026-21716)

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.(CVE-2026-21717)

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct.

When this occurs, dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch.

• This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x(CVE-2026-21710)

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.(CVE-2026-21713)

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.(CVE-2026-21714)

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.(CVE-2026-21715)

An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown()) were correctly patched.

As a result, code running under --permission with restricted --allow-fs-write can still use promise-based FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-write is intentionally restricted.(CVE-2026-21716)

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.(CVE-2026-21717)

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct.

When this occurs, dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch.

• This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x(CVE-2026-21710)

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.(CVE-2026-21713)

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.(CVE-2026-21714)

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.(CVE-2026-21715)

An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown()) were correctly patched.

As a result, code running under --permission with restricted --allow-fs-write can still use promise-based FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-write is intentionally restricted.(CVE-2026-21716)

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.(CVE-2026-21717)

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct.

When this occurs, dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch.

• This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x(CVE-2026-21710)

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.(CVE-2026-21713)

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.(CVE-2026-21714)

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.(CVE-2026-21715)

An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown()) were correctly patched.

As a result, code running under --permission with restricted --allow-fs-write can still use promise-based FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-write is intentionally restricted.(CVE-2026-21716)

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.(CVE-2026-21717)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs denial of service (CVE-2026-21637)

• brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

• minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

• undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

• undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

• undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

• undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

• undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

• undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

• nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

• Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

• Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

• Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

• nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

• Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

• Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

• Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

• nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs denial of service (CVE-2026-21637)

• minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

• undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

• undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

• undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

• undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

• undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

• undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

• nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

• Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

• Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

• Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

• nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

• Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

• Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

• Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

• nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Nodejs denial of service (CVE-2026-21637)

• brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

• minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

• undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

• undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

• undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

• undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

• undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

• undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

• nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

• Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

• Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

• Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

• nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

• Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

• Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

• Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

• nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs denial of service (CVE-2026-21637)
• brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
• minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
• undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
• undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
• undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
• undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
• undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
• undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
• nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
• Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
• Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
• Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
• nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
• Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
• Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
• Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
• nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs denial of service (CVE-2026-21637)
• minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
• undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
• undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
• undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
• undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
• undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
• undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
• nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
• Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
• Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
• Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
• nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
• Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
• Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
• Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
• nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Nodejs denial of service (CVE-2026-21637)
• brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
• minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
• undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
• undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
• undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
• undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
• undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
• undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
• nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
• Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
• Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
• Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
• nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
• Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
• Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
• Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
• nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.

Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS. (CVE-2026-21637) Denial of Service via proto header name in req.headersDistinct (Uncaught TypeError crashes Node.js process). (CVE-2026-21710) Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery. (CVE-2026-21713) Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion. (CVE-2026-21714) Permission Model Bypass in realpathSync.native Allows File Existence Disclosure. (CVE-2026-21715) CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown. (CVE-2026-21716) HashDoS in V8. (CVE-2026-21717)

These are all security issues fixed in the corepack24-24.14.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs24 fixes the following issues:

Update to version 24.14.1.

Security issues fixed:

• CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494).
• CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462).
• CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via fs.realpathSync.native() (bsc#1260482).
• CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via WINDOW_UPDATE frames sent on stream 0 (bsc#1260480).
• CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463).
• CVE-2026-21712: assertion error caused by flaw in URL processing allows for a process crash via a URL with a malformed IDN (bsc#1260460).
• CVE-2026-21710: uncaught TypeError when handling HTTP requests allows for a process crash via requests with a header named __proto__ when the application accesses req.headersDistinct (bsc#1260455).
• CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when pskCallback or ALPNCallback are in use (bsc#1256576).
• CVE-2025-59464: memory leak allows for remote denial of service against applications processing TLS client certificates (bsc#1256572).

Other updates and bugfixes:

• Version 24.14.0:
  • async_hooks: add trackPromises option to createHook()
  • build,deps: replace cjs-module-lexer with merve
  • deps: add LIEF as a dependency
  • events: repurpose events.listenerCount() to accept EventTargets
  • fs: add ignore option to fs.watch
  • http: add http.setGlobalProxyFromEnv()
  • module: allow subpath imports that start with #/
  • process: preserve AsyncLocalStorage in queueMicrotask only when needed
  • sea: split sea binary manipulation code
  • sqlite: enable defensive mode by default
  • sqlite: add sqlite prepare options args
  • src: add initial support for ESM in embedder API
  • stream: add bytes() method to node:stream/consumers
  • stream: do not pass readable.compose() output via Readable.from()
  • test: use fixture directories for sea tests
  • test_runner: add env option to run function
  • test_runner: support expecting a test-case to fail
  • util: add convertProcessSignalToExitCode utility
  • For details, see https://nodejs.org/en/blog/release/v24.14.0

This update for nodejs22 fixes the following issues

Update to 22.23.0:

• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
• CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

This update for nodejs24 fixes the following issues:

• Update to 24.14.1
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21712: malformed URL format can lead to a crash (bsc#1260460).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
• CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
• CVE-2026-21717: crafted request can lead to trivially predictable hash collisions (bsc#1260494).

This update for nodejs20 fixes the following issues:

Update to version 20.20.2.

• CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494).
• CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462).
• CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via fs.realpathSync.native() (bsc#1260482).
• CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via WINDOW_UPDATE frames sent on stream 0 (bsc#1260480).
• CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463).
• CVE-2026-21710: uncaught TypeError when handling HTTP requests allows for a process crash via requests with a header named __proto__ when the application accesses req.headersDistinct (bsc#1260455).
• CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when pskCallback or ALPNCallback are in use (bsc#1256576).

This update for nodejs20 fixes the following issues:

Update to version 20.20.2.

• CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494).
• CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462).
• CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via fs.realpathSync.native() (bsc#1260482).
• CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via WINDOW_UPDATE frames sent on stream 0 (bsc#1260480).
• CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463).
• CVE-2026-21710: uncaught TypeError when handling HTTP requests allows for a process crash via requests with a header named __proto__ when the application accesses req.headersDistinct (bsc#1260455).
• CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when pskCallback or ALPNCallback are in use (bsc#1256576).

This update for nodejs22 fixes the following issues:

Update to version 22.22.2.

• CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494).
• CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462).
• CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via fs.realpathSync.native() (bsc#1260482).
• CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via WINDOW_UPDATE frames sent on stream 0 (bsc#1260480).
• CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463).
• CVE-2026-21710: uncaught TypeError when handling HTTP requests allows for a process crash via requests with a header named __proto__ when the application accesses req.headersDistinct (bsc#1260455).
• CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when pskCallback or ALPNCallback are in use (bsc#1256576).

This update for nodejs22 fixes the following issues:

Update to version 22.22.2.

• CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494).
• CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462).
• CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via fs.realpathSync.native() (bsc#1260482).
• CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via WINDOW_UPDATE frames sent on stream 0 (bsc#1260480).
• CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463).
• CVE-2026-21710: uncaught TypeError when handling HTTP requests allows for a process crash via requests with a header named __proto__ when the application accesses req.headersDistinct (bsc#1260455).
• CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when pskCallback or ALPNCallback are in use (bsc#1256576).

This update for nodejs24 fixes the following issues:

Update to version 24.14.1.

Security issues fixed:

• CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494).
• CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462).
• CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via fs.realpathSync.native() (bsc#1260482).
• CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via WINDOW_UPDATE frames sent on stream 0 (bsc#1260480).
• CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463).
• CVE-2026-21712: assertion error caused by flaw in URL processing allows for a process crash via a URL with a malformed IDN (bsc#1260460).
• CVE-2026-21710: uncaught TypeError when handling HTTP requests allows for a process crash via requests with a header named __proto__ when the application accesses req.headersDistinct (bsc#1260455).
• CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when pskCallback or ALPNCallback are in use (bsc#1256576).
• CVE-2025-59464: memory leak allows for remote denial of service against applications processing TLS client certificates (bsc#1256572).

Other updates and bugfixes:

• Version 24.14.0:
  • async_hooks: add trackPromises option to createHook()
  • build,deps: replace cjs-module-lexer with merve
  • deps: add LIEF as a dependency
  • events: repurpose events.listenerCount() to accept EventTargets
  • fs: add ignore option to fs.watch
  • http: add http.setGlobalProxyFromEnv()
  • module: allow subpath imports that start with #/
  • process: preserve AsyncLocalStorage in queueMicrotask only when needed
  • sea: split sea binary manipulation code
  • sqlite: enable defensive mode by default
  • sqlite: add sqlite prepare options args
  • src: add initial support for ESM in embedder API
  • stream: add bytes() method to node:stream/consumers
  • stream: do not pass readable.compose() output via Readable.from()
  • test: use fixture directories for sea tests
  • test_runner: add env option to run function
  • test_runner: support expecting a test-case to fail
  • util: add convertProcessSignalToExitCode utility
  • For details, see https://nodejs.org/en/blog/release/v24.14.0

This update for nodejs22 fixes the following issues

Update to 22.23.0:

• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
• CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).