CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.

The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.

The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.

The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

• CVE-2026-105482: reject names and local addresses with null bytes in the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer silently truncate the queried name
• CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by the CVE-2026-48618 fix since els15
• CVE-2026-105481: check for unread data in the OS socket buffer before http.Agent reuses a keep-alive socket and destroy the socket if any

• CVE-2026-105482: reject names and local addresses with null bytes in the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer silently truncate the queried name
• CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by the CVE-2026-48618 fix since els15
• CVE-2026-105481: check for unread data in the OS socket buffer before http.Agent reuses a keep-alive socket and destroy the socket if any

These are all security issues fixed in the corepack24-24.22.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)
• CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)
• CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)
• CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)
• CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)
• CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)
• CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)
• CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)
• CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)
• CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)
• CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• Update to 22.23.3:
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• deps: update Undici to 6.28.1
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• Update to 22.23.3:
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• deps: update Undici to 6.28.1
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs24 fixes the following issues:

Security issues fixed:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Non security issue fixed:

• 'npm install -h' output is truncated (bsc#1276224).

Changes for nodejs24:

• Update to 24.22.1:
• crypto: update root certificates to NSS 3.131.1
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update undici to 7.30.1
• Update to 24.22.0:
• crypto: add crypto.parsePKCS12()
• crypto: discover ciphers and hashes from OpenSSL providers
• crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
• doc: deprecate Server.prototype._listen2 in node:net
• net: support sending net.BoundSocket to threads and child processes
• perf_hooks: implement SlidingWindowHistogram
• perf_hooks: implement qrde analysis support in Histogram
• perf_hooks: implement Histogram meanCI API
• perf_hooks: add CBOR export/import for histogram exchange
• sqlite: add StatementSync.prototype.close()
• sqlite: add StatementSync.prototypeSymbol.dispose
• src,lib: add util.markPromiseAsHandled
• util: implement util.throttle
• util: implement debounce
• Update to 24.21.0:
• crypto: update root certificates to NSS 3.126
• crypto: support loading private keys through STORE loaders
• deps: update Undici to 7.29.1
• lib,src: improve histogram implementation
• net: improve performance of net.BlockList
• perf_hooks: add statistical hypothesis testing to histogram
• util: add non-throwing MIMEType.parse
• Update to 24.20.0:
• async_hooks: add using scopes to AsyncLocalStorage
• buffer: add end parameter
• doc: add MikeMcC399 as collaborator
• lib,permission: add permission.drop
• loader: implement package maps
• src,permission: add --permission-audit
• stream: add node:stream/iter implementation
• test_runner: add context.log() and test:log event
• test_runner: report entryFile in TestStream events
• wasm: enable JSPI
• Update to 24.19.0:
• buffer: implement blob.textStream()
• deps: update OpenSSL build config to support compression
• doc: update blockList stability status to release candidate
• doc: mark stream.compose stable
• esm: add --experimental-import-text flag
• fs: support caller-supplied readFile() buffers
• http: add httpValidation option to configure header value validation
• net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
• perf_hooks: sample delay per event loop iteration
• src: allow empty --experimental-config-file
• stream: expose ReadableStreamTee
• tls: report negotiated TLS groups
• tls: add certificateCompression option