CVE-2026-48930

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

• undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

• undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

• undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

• undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-186622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

• undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

• undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:Rocky Linux-176170)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
• undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
• undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
• undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
• undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-9.8.z] (JIRA:AlmaLinux-186622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
• undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
• undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8] (JIRA:AlmaLinux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
• undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
• undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
• undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
• undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

• nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-8] (JIRA:AlmaLinux-176170)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

• CVE-2026-48930: reject hostnames with embedded NUL bytes in dns.lookup and net.connect to prevent silent authority rebinding
• CVE-2026-48619: cap the HTTP/2 client ORIGIN set size to prevent unbounded memory growth
• CVE-2026-48618: normalize hostname to ASCII for TLS server identity checks
• CVE-2026-48928: make SNI context matching case-insensitive

• CVE-2026-48930: reject hostnames with embedded NUL bytes in dns.lookup and net.connect to prevent silent authority rebinding
• CVE-2026-48619: cap the HTTP/2 client ORIGIN set size to prevent unbounded memory growth
• CVE-2026-48618: normalize hostname to ASCII for TLS server identity checks
• CVE-2026-48928: make SNI context matching case-insensitive

lib,test: redact proxy credentials in tunnel errors. (CVE-2026-48615) permission: handle process.chdir on writereport. (CVE-2026-48617) tls: normalize hostname for server identity checks. (CVE-2026-48618) http2: cap originSet size to prevent unbounded memory growth. (CVE-2026-48619) tls: fix case-sensitive SNI context matching. (CVE-2026-48928) dns,net: reject hostnames with embedded NUL bytes. (CVE-2026-48930) http: fix response queue poisoning in http.Agent. (CVE-2026-48931) crypto: guard WebCrypto cipher output length. (CVE-2026-48933) tls: bind reusable sessions to authenticated host. (CVE-2026-48934) permission: disable FileHandle utimes with permission model. (CVE-2026-48935) deps: fix integration issues with the latest nghttp2. (CVE-2026-48937)

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack24-24.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs22 fixes the following issues

Update to 22.23.0:

• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
• CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

• CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
• CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
• CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
• CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

• Version 24.18.0:
  • doc: update blockList stability status to release candidate
  • fs: support caller-supplied readFile() buffers
  • http: close pre-request sockets in closeIdleConnections
  • loader: implement package maps
  • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
  • tls: add certificateCompression option
  • vfs: dispatch node:fs/promises to mounted VFS instances
  • vfs: add minimal node:vfs subsystem
• For changes in older versions, see https://github.com/nodejs/node/releases.
• Remove update-alternatives from scriptlets if not available.
• Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
• Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.

This update for nodejs22 fixes the following issues

Update to 22.23.0:

• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
• CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

• CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
• CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
• CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
• CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

• Version 24.18.0:
  • doc: update blockList stability status to release candidate
  • fs: support caller-supplied readFile() buffers
  • http: close pre-request sockets in closeIdleConnections
  • loader: implement package maps
  • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
  • tls: add certificateCompression option
  • vfs: dispatch node:fs/promises to mounted VFS instances
  • vfs: add minimal node:vfs subsystem
• For changes in older versions, see https://github.com/nodejs/node/releases.
• Remove update-alternatives from scriptlets if not available.
• Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
• Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.

This update for nodejs24 fixes the following issues

Update to 24.17.0:

• CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing (bsc#1268478).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

This update for nodejs22 fixes the following issues

Update to 22.23.0:

• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

This update for nodejs22 fixes the following issues:

• CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
• CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
• CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
• CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
• CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
• CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
• CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
• CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
• CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
• CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
• CVE-2026-48937: http2: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479).
• CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477).
• CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec ( bsc#1266318).
• CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).

This update for nodejs20 fixes the following issues:

• CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
• CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
• CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
• CVE-2026-69192: ip-address: Address4…

This update for nodejs20 fixes the following issues:

• CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
• CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
• CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
• CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
• CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
• CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
• CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
• CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
• CVE-2026-69192: ip-address: Address4…

This update for nodejs18 fixes the following issues:

• CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS…

This update for nodejs18 fixes the following issues:

• CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
• CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
• CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS…

This update for nodejs16 fixes the following issues:

• CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250).
• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
• CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
• CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
• CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
• CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
• CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
• CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
• CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
• CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
• CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
• CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
• CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
• CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
• CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
• CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
• CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
• CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
• CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
• CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
• CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).